How to hide "server' response header

Security
1

I’d like to hide the server response header. Dropping the header from virtual service definition doesn’t help.

  http:
  - headers:
      response:
        remove:
        - x-envoy-upstream-service-time
        - server

x-envoy-upstream-service-time is removed but not server. What do I have to do to drop that header? or override the header?

2

This worked for me. https://github.com/istio/istio/issues/13861

3

Thanks for sharing the information! It works for me.