Home / server / Questions / 1166508
Accepted
ku4eto
Asked: 2024-10-12 18:42:22 +0800 CST

IIS 10: How to remove server and NET headers

  • 772

The setup is as follows:

Windows Server 2022 Standard with IIS 10.

ASP .NET 4.8 based application, running with Integrated mode and Application Pool Identity.

Im trying to remove the following headers:

Server , X-Powered-By, X-ASPNet-Version, X-ASPNetMVC-Version.

No matter what is done, the headers remain.

Things tried:

  1. Remove on server level from RESPONSE HEADERS the X-Powered-By header - no effect, still shows up on dynamic content.

  2. Set enableVersionHeader in server applicationhost.config configuration file and in application configuration file with no effect:

<configuration>
  <system.web>
    <httpRuntime enableVersionHeader="false" />
  </system.web>
</configuration>
  1. Set on server level with no effect:
<configuration>
  <system.webServer>
    <security>
      <requestFiltering removeServerHeader="true" />
    </security>
  </system.webServer>
</configuration>

  1. Set the DisableServerHeader DWORD registry value to 1 and restarted IIS with no effect: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters!DisableServerHeader

  2. Tried modifying the Global.asax to remove the ASPNetMVC header, but it broke the application.

I confirmed, that the changes on server level go down to the website level. I tried setting it up also manually in the web.config on the site. Same effect (none).

URL Scan is no longer available, so it is not an option. Last option seems to be to use URL Rewrite, but I would rather not use it if possible, given there are supposedly native solutions for that.

What am I doing wrong and is there something I am missing?

iis

3 Answers

  1. These kind of Headers can either be added at Website level or IIS at level. Once you click on Website in your IIS console, open HTTP Response headers, you should see the list of headers here along with the Entry Type. If the entry type is Inherited, that means this entry is still at your IIS level. You can validate this in your applicationhost.config.

            <customHeaders>
            <clear />
            <add name="X-Powered-By" value="ASP.NET" />
        </customHeaders>

    You can either remove it from here or, you can remove this from the IIS Console, after clicking on the Server and open the HTTP Response headers, remove it and validate the response.

    • 0
  2. Best Answer

    Seems like something went wrong with the site along the way. I deleted it and created it again, which somehow fixed the issue. The site web.config was still absolutely the same, but the header related changes started to work. And i do not know if its me not understanding or simply not working the way i expect it to do, but the X-ASPNetMVC-Version had to be put in the application source code file Global.asax.cs, not in one at runtime (ie, after build/deploy). Thank you for the offered answers and help.

    • 0

  3. I think you can edit web.config that should be distributed with your application and add following lines:

        <system.webServer>
...
        <httpProtocol>
            <customHeaders>
                <remove name="X-Powered-By" />
                <remove name="Server" />                
            </customHeaders>
        </httpProtocol>
    • -1