2

IIS reveals "Server: Microsoft-HTTPAPI/2.0" in the response header when a invalid Post request is made. e.g. content-length is not included in the header. The Response returned also says HTTP/1.1 411 Length Required.

the closest case i have found was this forum post at iis.net: http://forums.iis.net/t/1178183.aspx/1 but still not having any luck.

i have also attempted to implement this: http://blogs.technet.com/b/stefan_gossner/archive/2008/03/12/iis-7-how-to-send-a-custom-server-http-header.aspx and it doesnt stop the server header from being added / renamed

My client is asking for all "Server" headers to be removed as part of their security requirements. (don't ask me why, i'm just the schmuck who just has to get it done)

anyone encounter this before?

Improve this question
4
  • My condolences. Programs like nmap will find out much more than what the offending header might divulge anyway. An extremely dirty solution would be to overwrite those strings in the executable with something of the same length...
    – vonbrand
    Commented Feb 19, 2013 at 3:24
  • The blog article in question was: blog.paulbouwer.com/2013/01/09/…
    – munsense
    Commented Feb 19, 2013 at 4:15
  • OK, doing what is suggested there then solved your problem? If so, please summarize what has to be done, where you stumbled and how you fixed it in the end as an answer, and accept it later to close the issue.
    – vonbrand
    Commented Feb 19, 2013 at 4:28
  • 1
    @vonbrand sure thing. edited my question with an answer below. will add answer again later.
    – munsense
    Commented Feb 19, 2013 at 5:30

1 Answer 1

Reset to default
3

Stumbled on Paul Bouwer's blog.

Turns out that when the "Microsoft-HTTPAPI/2.0" server header appears, it means that the HTTP.SYS driver has handled the request and it never gets to IIS for processing. makes sense, why waste time sending to IIS when you can tackle an invalid request as early as possible.

in order to stop HTTP.SYS from adding the server header a REG_DWORD needs to be added to the registry: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

add a REG_DWORD called "DisableServerHeader" with a value of 1.

I wasnt keen on trying to find a way to restart the driver and deal with the dependencies so i rebooted the machine.

after reboot, tested with Fiddler and everything worked fine.

Improve this answer
1
  • 1
    The reboot is key. Just doing an iisreset won't make the server header go away.
    – csm8118
    Commented Jun 20, 2013 at 4:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .