Now Chatting

Hello, can I help you with anything?

IIS

Response headers are added in different places:

  • Server: added by IIS.
  • X-AspNet-Version: added by System.Web.dll at the time of Flush in HttpResponse class
  • X-AspNetMvc-Version: Added by MvcHandler in System.Web.dll.
  • X-Powered-By: added by IIS

To remove the Server header we add the following method and code to the Global.asax.cs file in the WebAPI project:
protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
HttpContext.Current.Response.Headers.Remove("Server");
}

To remove the X-AspNet-Version header ensure that the Web.config has the following xml:

<configuration>
   <system.web>
      <httpRuntime enableVersionHeader="false" />
    </system.web>
</configuration>

To remove X-AspNetMvc-Version, go to Global.asax, find/create the Application_Start event and add a line as follows:

protected void Application_Start()
   {
      MvcHandler.DisableMvcResponseHeader = true;
   }

To remove the X-Powered-By header ensure that the Web.config has the following xml:

<configuration>
   <system.webServer>
      <httpProtocol>
         <customHeaders>
            <remove name="X-Powered-By" />
         </customHeaders>
      </httpProtocol>
   </system.webServer>
</configuration>

To suppress all the other headers ensure that the Web.config contains the following xml:

<configuration>
   <nwebsec>
      <httpHeaderModule>
          <suppressVersionHttpHeaders enabled="true" />
      </httpHeaderModule>
   </nwebsec>
</configuration>

If the header value shows Microsoft-HTTPAPI/2.0 then add a DisbableServerHeader REG_DWORD with a value of 1 to the following:

HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

This requires the HTTP.SYS service to be restarted

APACHE

Servlet 2.5; JBoss5.0/JBossWeb2.1

PHP Version