Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information through response headers. I have removed all the HTTP-HEADERS out of the IIS configuration for the website (X-Powered-By or some such header).

(I personally do know that this information can be easily found out, even if it is hidden, but it isn't my call.)

Headers I want to remove:

  • Server - Microsoft-IIS/6.0
  • X-AspNet-Version - 2.0.50727

I also know that ASP.NET MVC also emits its own header too, if you know how to remove it also, that would be helpful.

  • X-AspNetMvc-Version - 1.0
share|improve this question
add comment

4 Answers

up vote 27 down vote accepted

Your security department wants you to do this to make the server type harder to identify. This may lessen the barrage of automated hacking tools and make it more difficult for people to break into the server.

Within IIS, open the web site properties, then go to the HTTP Headers tab. Most of the X- headers can be found and removed here. This can be done for individual sites, or for the entire server (modify the properties for the Web Sites object in the tree).

For the Server header, on IIS6 you can use Microsoft's URLScan tool to remote that. Port 80 Software also makes a product called ServerMask that will take care of that, and a lot more, for you.

For IIS7, there is a great article on using a custom module to modify the Server header.

For the MVC header, in Global.asax:

MvcHandler.DisableMvcResponseHeader = true;
share|improve this answer
2  
Accepted answer, wish I could share the answer with @squillman. Web.config to fix X-AspNet-Version: <system.web> <httpRuntime enableVersionHeader="false" /> </system.web> –  Bryan Rehbein Jun 12 '09 at 17:44
    
The X header removal puts this in my web.config, so save yourself some time: <system.webServer> <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> </customHeaders> </httpProtocol> </system.webServer> –  Broam Dec 3 '09 at 14:44
    
Broam, that's the right answer ... for IIS7. The question is about IIS6. That has no effect on IIS6. –  Anthony Oct 11 '12 at 10:05
add comment

To remove all custom headers that disclose too much information - the methods are varied (unfortunately) for IIS 7:

Header Name: X-Powered-By

Add:

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By" />
  </customHeaders>
</httpProtocol>

in the <system.webServer> section.

Header Name: Server

Implement an httpModule that strips this header out by calling Response.Headers.Remove("Server") from the PreSendRequestHeaders event. Another resource for this: Cloaking your ASP.NET MVC Web Application on IIS 7

Header Name: X-AspNet-Version

In the httpRuntime section of the web.config - set:

<httpRuntime enableVersionHeader="false" />

Header Name: X-AspNetMvc-Version

From the Application_Start event in global.asax - execute the following code (C#):

MvcHandler.DisableMvcResponseHeader = true;
share|improve this answer
add comment

Putting this in an ASP.NET application's web.config file will get rid of the X-AspNet-Version header:

<system.web>
<httpRuntime enableVersionHeader="false" />
</system.web>

Note that the system.web tag should already exist in the file. Don't create a duplicate, just add the httpRuntime tag. The httpRuntime tag might also already exist. If so, just add the attribute or set its value if it's already there.

share|improve this answer
    
Nice........... –  UpTheCreek Feb 3 '11 at 13:46
    
However this leaves the 'powered by' header. –  UpTheCreek Feb 3 '11 at 14:08
add comment

having just been through the "hardening" cycle on my current project - I blogged about the approach we took, which includes a HTTPModule for removing the following headers:

Server, X-AspNet-Version, X-AspNetMvc-Version, X-Powered-By,

http://blogs.conchango.com/howardvanrooijen/archive/2009/08/25/cloaking-your-asp-net-mvc-web-application-on-iis-7.aspx

share|improve this answer
1  
Suppress the generation of the headers by configuration seems to make much more sense than having the headers generated and then remove it. –  markus Aug 25 '10 at 7:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.