IIS reveals "Server: Microsoft-HTTPAPI/2.0" in the response header when a invalid Post request is made. e.g. content-length is not included in the header. The Response returned also says HTTP/1.1 411 Length Required.

the closest case i have found was this forum post at iis.net: http://forums.iis.net/t/1178183.aspx/1 but still not having any luck.

i have also attempted to implement this: http://blogs.technet.com/b/stefan_gossner/archive/2008/03/12/iis-7-how-to-send-a-custom-server-http-header.aspx and it doesnt stop the server header from being added / renamed

My client is asking for all "Server" headers to be removed as part of their security requirements. (don't ask me why, i'm just the schmuck who just has to get it done)

anyone encounter this before?

  • My condolences. Programs like nmap will find out much more than what the offending header might divulge anyway. An extremely dirty solution would be to overwrite those strings in the executable with something of the same length... – vonbrand Feb 19 '13 at 3:24
  • The blog article in question was: blog.paulbouwer.com/2013/01/09/… – munsense Feb 19 '13 at 4:15
  • OK, doing what is suggested there then solved your problem? If so, please summarize what has to be done, where you stumbled and how you fixed it in the end as an answer, and accept it later to close the issue. – vonbrand Feb 19 '13 at 4:28
  • 1
    @vonbrand sure thing. edited my question with an answer below. will add answer again later. – munsense Feb 19 '13 at 5:30

Stumbled on Paul Bouwer's blog.

Turns out that when the "Microsoft-HTTPAPI/2.0" server header appears, it means that the HTTP.SYS driver has handled the request and it never gets to IIS for processing. makes sense, why waste time sending to IIS when you can tackle an invalid request as early as possible.

in order to stop HTTP.SYS from adding the server header a REG_DWORD needs to be added to the registry: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

add a REG_DWORD called "DisableServerHeader" with a value of 1.

I wasnt keen on trying to find a way to restart the driver and deal with the dependencies so i rebooted the machine.

after reboot, tested with Fiddler and everything worked fine.

  • 1
    The reboot is key. Just doing an iisreset won't make the server header go away. – csm8118 Jun 20 '13 at 4:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.