Quieten down noisy HTTP headers

31 October 2016 markporter

This is not a new article, and blatantly steals from two other extremely helpful sources on this topic namely

https://www.troyhunt.com/shhh-dont-let-your-response-headers/ and

https://www.saotn.org/remove-iis-server-version-http-response-header/. The reason for this article is to update the references slightly as I found a few changes during a recent ASP.NET MVC deployment to an Azure App Service.

Starting with the simplest first the X-AspNetMvc-Version header can be removed by adding a line to Global.asax.

MvcHandler.DisableMvcResponseHeader = true;

This is pretty clear and is obviously specific to ASP.NET MVC, but it can also be removed using changes to web.config to remove custom headers – this is the approach required to remove the X-Powered-By header.

<system.webServer>
    <httpProtocol>
        <customHeaders>
            <remove name="X-Powered-By"/>
            <!-- can also remove the MVC version header using this approach -->
            <!-- <remove name="X-AspNetMvc-Version"/> -->
        </customHeaders>
    </httpProtocol>
</system.webServer>

<system.webServer>
    <httpProtocol>
        <customHeaders>
            <remove name="X-Powered-By"/>
            <!-- can also remove the MVC version header using this approach -->
            <!-- <remove name="X-AspNetMvc-Version"/> -->
        </customHeaders>
    </httpProtocol>
</system.webServer>

The X-AspNet-Version header can also be removed by amending config, just unset the system.web httpRuntime enableVersionHeader attribute.

<system.web>
    <httpRuntime enableVersionHeader="false" />
</system.web>

Removing the Server header in Azure App Services is apparently very easy now. The long story is that in IIS 10 an attribute was added to config to allow removal of server header. Now the version of IIS reported by Azure at the time of publishing is 8, however, the removeServerHeader attribute does actually work? Sources indicate that Azure is running a custom version of IIS that is not in line with any OS version.

So cutting to the chase to remove the Server header in Azure App Services you just need to amend web.config to set the removeServerHeader attribute.

<system.webServer>
    <security>
        <requestFiltering removeServerHeader="true">
        </requestFiltering>
    </security>
</system.webServer>

The existing approaches still work of course, the most often used one was to blank out the Server header using a rewrite rule.

<system.webServer>
    <rewrite>
        <outboundRules>
            <rule name="Blank Server header">
                <match serverVariable="RESPONSE_Server" pattern=".+" />
                <action type="Rewrite" value=""/>
            </rule>
        </outboundRules>
    </rewrite>
</system.webServer>