19

I'm trying to remove the Server Header which discloses IIS version but couldn't. I'm using IIS Express 10 with ASP.NET Core 3.0 and have developed a Web API. I've tried below options but still header is present in response and reveals the Version IIS 10.0.

  1. Changed registry key "DisableServerHeader" in HTTP Parameters to 1. It only removed Server header of http.sys module not the IIS version.

  2. Used below code in applicationhost.config file within <system.webServer> tag

    <rewrite> <outboundRules rewriteBeforeCache="true"> <rule name="Remove Server header"> <match serverVariable="RESPONSE_Server" pattern=".+" /> <action type="Rewrite" value="" /> </rule> </outboundRules> </rewrite>

RaJ
  • 291
  • 1
  • 2
  • 5
  • 1
    Set up a reverse proxy server in front and remove the server header from there. Save you tons of hours. – Lex Li Nov 08 '19 at 05:51
  • @LexLi seems like that's the way to go. I'm starting to get tired of making settings here and there in code, config files and what not. Since i have developed this api for educational purpose, i'll see if it's worth setting up a reverse proxy but still i appreciate your idea. Thanks Buddy! – RaJ Nov 08 '19 at 06:16

4 Answers4

24

I tested the trick on this site and it works well on IIS 10.

https://www.saotn.org/remove-iis-server-version-http-response-header/#removeserverheader-requestfiltering-in-iis-10-0

Simple web.config:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>
            <requestFiltering removeServerHeader="true" />
        </security>
    </system.webServer>
</configuration>
M.R.T
  • 341
  • 2
  • 6
7

Run as Administrator:

%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.webServer/security/requestFiltering /removeServerHeader:"True"  /commit:apphost
hienbuithanh88
  • 171
  • 1
  • 2
7

There have already been plenty of good answers, however I'd like to show a different approach for users like me, who like to use Windows GUI IIS Management Console "Internet Information Services (IIS) Manager" with the shipped "Configuration Editor". By going that path you'll also avoid crashing your IIS because of malformated configuration files, as happened to one of the commenters. The 'Configuration Editor' will apply the changes in the IIS configuration files for you. Also, you can set these settings globally or on a per site manner just as you wish without the need of editing the files manually or applying powershell/cmd commands.

  1. Open "Internet Information Services (IIS) Manager".

  2. If you want to set the settings globally, click on your main server node: select iis node

  3. Open the "Configuration Editor" open configuration editor

  4. To remove 'x-aspnet-version' response header, go to system.web >> httpRuntime >> enableVersionHeader and set it to 'false' disable server response header

  5. To remove the IIS 'server' response header, go to system.webServer >> security >> requestFiltering >> removeServerHeader and set it to 'true' remove IIS server header

For setting the values per site, just click on the site you want to apply the changes, and select the Configuration Editor from there.

AndreasRu
  • 171
  • 1
  • 2
5

I remembered I've seen this is possible in IIS10, and indeed I blogged about this in New features in IIS 10.

There is a new removeServerHeader setting, but it is not available in the GUI, you have to use the Configuration Editor or use PowerShell:

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST'  -filter "system.webServer/security/requestFiltering" -name "removeServerHeader" -value "True"

for the whole server, if you just need it for a site, use:

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site'  -filter "system.webServer/security/requestFiltering" -name "removeServerHeader" -value "True"

This seems to work fine for me, no reboot or restart of IIS is required.

It doesn't affect the http.sys server header in the rare case that it responses to a request.

Peter Hahndorf
  • 13,763
  • 3
  • 37
  • 58
  • The first command above broke my server. – Spencer Sullivan May 20 '20 at 15:21
  • @SpencerSullivan - So, what happened? Your server doesn't boot anymore? If there is a problem we need details. – Peter Hahndorf May 25 '20 at 07:21
  • I had to replace the applicationHost.config with a backed up copy. There must have been something whacked with my configuration before running your suggestion. I gave you the upvote anyway as I think the issue was something I did and NOT your suggestion. Since then, I was able to remove the Server Response Header successfully. Thank you for the follow up. – Spencer Sullivan Jun 01 '20 at 16:13