Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My client is having their website validated in order to accept card payments on the site, and one of the failures is that we are leaking the internal IP address, yet we are using IIS 7.0 which I thought didn't do that.

I've checked the headers myself and can't see where the problem lies:

HTTP/1.1 302 Found
Content-Type: text/html 
Server: Microsoft-IIS/7.0 
X-Powered-By: ASP.NET Date: Tue, 03 Aug 2010 08:21:08 GMT 
Content-Length: 156 

HTTP/1.1 200 OK 
Cache-Control: private 
Content-Type: text/html 
Server: Microsoft-IIS/7.0 
Set-Cookie: ASP.NET_SessionId=n4cf1m3qmmocof45bxwpwe55 
X-AspNet-Version: 2.0.50727 
X-Powered-By: ASP.NET Date: Tue, 03 Aug 2010 08:21:08 GMT 
Content-Length: 12015 

Any ideas what they could be talking about?

share|improve this question
up vote 2 down vote accepted

Ok the problem was that in IIS there was no host-header specified for HTTPS (443) protocol, so once I added this it was ok.

Changing the setting was a little tricky though, as for single domain certs IIS does not let you specify a host header, so you have to go into the CA on the server, give the cert a friendly name that begins with an asterisk, and IIS will then allow you to specify the host-header.

share|improve this answer

There's a ton of places it could be leaked, possibly even in the application. What are the check results? Without more knowledge about your infrastructure or more details about how they proved it was failing, it will be difficult to answer your question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.