Having just been through the "hardening" cycle on my current project - I blogged about the approach we took, which includes a HTTPModule for removing the following headers:
Server,
X-AspNet-Version,
X-AspNetMvc-Version,
X-Powered-By
Pertinent pieces reproduced below:
But there is no easy way to remove the Server response header via configuration. Luckily IIS7 has a managed pluggable module infrastructure which allows you to easily extend its functionality. Below is the source for a HttpModule for removing a specified list of HTTP Response Headers:
namespace Zen.Core.Web.CloakIIS
{
#region Using Directives
using System;
using System.Collections.Generic;
using System.Web;
#endregion
/// <summary>
/// Custom HTTP Module for Cloaking IIS7 Server Settings to allow anonymity
/// </summary>
public class CloakHttpHeaderModule : IHttpModule
{
/// <summary>
/// List of Headers to remove
/// </summary>
private List<string> headersToCloak;
/// <summary>
/// Initializes a new instance of the <see cref="CloakHttpHeaderModule"/> class.
/// </summary>
public CloakHttpHeaderModule()
{
this.headersToCloak = new List<string>
{
"Server",
"X-AspNet-Version",
"X-AspNetMvc-Version",
"X-Powered-By",
};
}
/// <summary>
/// Dispose the Custom HttpModule.
/// </summary>
public void Dispose()
{
}
/// <summary>
/// Handles the current request.
/// </summary>
/// <param name="context">
/// The HttpApplication context.
/// </param>
public void Init(HttpApplication context)
{
context.PreSendRequestHeaders += this.OnPreSendRequestHeaders;
}
/// <summary>
/// Remove all headers from the HTTP Response.
/// </summary>
/// <param name="sender">
/// The object raising the event
/// </param>
/// <param name="e">
/// The event data.
/// </param>
private void OnPreSendRequestHeaders(object sender, EventArgs e)
{
this.headersToCloak.ForEach(h => HttpContext.Current.Response.Headers.Remove(h));
}
}
}
Ensure that you sign the assembly, then you can install it into the GAC of your web servers and simply make the following modification to your application’s web.config (or if you want it to be globally applied, to the machine.config):
<configuration>
<system.webServer>
<modules>
<add name="CloakHttpHeaderModule"
type="Zen.Core.Web.CloakIIS.CloakHttpHeaderModule, Zen.Core.Web.CloakIIS,
Version=1.0.0.0, Culture=neutral, PublicKeyToken=<YOUR TOKEN HERE>" />
</modules>
</system.webServer>
</configuration>
