Why aren't the Server and X-Powered-By headers being removed?

Question

My ASP.NET 4.5 app is being deployed to shared hosting so I do not have access to IIS settings. To remove the X-Powered-By header, I specify in web.config:

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

And to remove the Server header, I specify in Global.asax:

protected void Application_PreSendRequestHeaders(object sender, EventArgs e) {
  HttpContext.Current.Response.Headers.Remove("Server");
}

However, responses still contain both headers:

Cache-Control:private
Content-Encoding:deflate
Content-Length:672
Content-Type:text/html; charset=utf-8
Date:Sun, 06 Jan 2013 00:41:20 GMT
Server:Microsoft-IIS/7.5
X-Powered-By:ARR/2.5
X-Powered-By:ASP.NET

How can I remove them?

You may have to write a custom HttpModule to do this for you - see [this question](http://stackoverflow.com/questions/11751644/azure-webrole-excesive-headers) — James, Jan 06 '13 at 01:31
Thanks, I'll give it a try. But doesn't that `HttpModule` just do the same as my method in `Global.asax`? — James, Jan 06 '13 at 01:33
Your absolutely right mate, I skimmed over that part of your code, see my answer — James, Jan 06 '13 at 01:45

score 6 · Answer 1 · answered May 14 '13 at 12:44

I'm not sure why your X-Powered-By isn't being removed, but a Windows Update patch earlier this year made it so that the Application_PreSendRequestHeaders fix no longer removed the Server: header for us.

We had to add a section to our system.webServer block (in the Web.config) using IIS URL Rewrite Module 2:

<rewrite>
    <outboundRules>
        <rule name="Remove RESPONSE_Server">
            <match serverVariable="RESPONSE_Server" pattern=".+"/>
            <action type="Rewrite" value=""/>
        </rule>
    </outboundRules>
</rewrite>

Frédéric · Answer 2 · 2019-03-01T18:05:17.043

The X-Powered-By:ASP.NET is normally removed by simple web.config configuration:

<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
...

The ARR one is unaffected by this configuration, it has to be removed through the IIS Manager, Editor configuration on the IIS root (not on a site): go to system.webServer/proxy node and set arrResponseHeader to false. After an IISReset, it is taken into account.
I have found this one here, excepted this post is about old IIS 6.0 way of configuring things.

So for your case, without access to IIS settings, you would have to ask the server owner to adjust his configuration. Or try the Url Rewrite solution but of course, with HTTP_X_Powered_By server variable. It will at best only blank out the header, and I have not checked it works for the ARR case.

James · Answer 3 · 2013-01-06T02:07:30.437

0

If you are using IIS 7 setting the DisableMvcResponseHeader property to true in the Global.asax should remove the "X-Powered-By" header

protected void Application_Start()
{
    MvcHandler.DisableMvcResponseHeader = true;
}

edited Jan 06 '13 at 02:07

answered Jan 06 '13 at 01:42

James

80,725
18
167
237

Hmm that is weird because it should work for IIS 7. Have you tried using the http module example I linked to? – James Jan 06 '13 at 02:11
Not at my dev machine at the moment, will try when I can. Thanks. – James Jan 06 '13 at 02:18
1

This one is for `X-AspNetMvc-Version` header, not for `X-Powered-By`. I have written an answer covering the different headers case I am aware of [here](https://stackoverflow.com/a/17600445/1178314). – Frédéric Mar 01 '19 at 18:14

score 0 · Answer 4 · answered Jul 07 '17 at 05:31

Mostly server IIS doesn't allow us to remove server tags. You can try following code to achieve your goal. Add in Global.asax

protected void Application_PreSendRequestHeaders()
{
    Response.Headers.Remove("X-AspNet-Version");
     HttpContext.Current.Response.Headers.Set("Server", "");
 }

This code will remove your "X-AspNet-Version" and set Server value as blank.

Why aren't the Server and X-Powered-By headers being removed?

4 Answers4