Remove response Server header on Azure Web App from the first redirect request to HTTPS

Question

I’m trying to remove the response Server header from an Azure Web App ( with an ASP Net core application )

After many tries of changing the web.config and removing the header in app code using a middleware, Microsoft doesn’t give up and set the response header to Server: Microsoft-IIS/10.0 :)

The problem appears only when I’m trying to access the server on http (not https). Response code from the server is 301, and this is the only response that has the Server header.

Checking the logs I was not able to find any request to http://, and perhaps this is why I’m not able to remove header, because the request is not process in my application code.

A solution that I’m thinking is to disable the azure HTTPS only and do the redirect to https in my code (I tested and is working - server header is removed)

Is there another workaround without disabling the HTTPS only option?

Here is what I tried

Startup.cs

    public void Configure(IApplicationBuilder app)
    {
        app.Use(async (context, next) =>
        {
            context.Response.Headers.Add("server", string.Empty)
        }
        app.UseHttpsRedirection();
    }

web.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <httpRuntime enableVersionHeader="false" />
        <!-- Removes ASP.NET version header.  -->
    </system.web>
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <remove name="Server" />
                <remove name="X-Powered-By" />
            </customHeaders>
            <redirectHeaders>
                <clear />
            </redirectHeaders>      
        </httpProtocol>
        <security>
            <requestFiltering removeServerHeader="true" />
            <!-- Removes Server header in IIS10 or later and also in Azure Web Apps -->
        </security>
        <rewrite>  
            <outboundRules>
                <rule name="Change Server Header"> <!-- if you're not removing it completely -->
                  <match serverVariable="RESPONSE_Server" pattern=".+" />
                    <action type="Rewrite" value="Unknown" />
                </rule>
            </outboundRules> 
        </rewrite>      

    </system.webServer>
</configuration>

This doesn't fix the problem. If you make the request to http ( not https) The first response (301) has the server name. See the capture: imgur.com/a/8FtyfDK — James

Jason Pan Jason Pan · Accepted Answer · 2020-04-29T04:13:19

UPDATE

When the URL of http:// is requested, IIS will process it, this time without code. So we can't control it by the code, we can only set it on the server, such as some scripts or tools. But on Azure, we have no way to directly operate as a physical server, so after exploration, I suggest that Front Door can be used to deal with this problem. Hiding server information through proxy should be a better way.

After my test, the server information is hidden, you can refer to this document . We can see from the picture that there is no 301 redirect request, and no server information in other requests.

PREVIOUS

You need to modify Global.asax.cs and Web.config file in your program.

In Global.asax.cs.

 public class MvcApplication : System.Web.HttpApplication
 {
    protected void Application_Start()
    {
        AreaRegistration.RegisterAllAreas();
        FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
        RouteConfig.RegisterRoutes(RouteTable.Routes);
        BundleConfig.RegisterBundles(BundleTable.Bundles);
        MvcHandler.DisableMvcResponseHeader = true;
        PreSendRequestHeaders += Application_PreSendRequestHeaders;
    }

    protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
    {
        //HttpContext.Current.Response.Headers.Remove("Server");
        HttpContext.Current.Response.Headers.Set("Server","N/A");
    }
 }

And In Web.config.

<system.webServer>
  <modules runAllManagedModulesForAllRequests="true" >
  </modules>  
  <httpProtocol>
    <customHeaders>
       <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

Then u can deploy your app. After the above code modification, access to the interface or static resources can see that the server information is modified, of course, it can also be deleted by Remove.

You also can handle special event by http status code.

protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
     //HttpContext.Current.Response.Headers.Remove("Server");
     int StatusCode= HttpContext.Current.Response.StatusCode;
     // handle like http status code 301 
     HttpContext.Current.Response.Headers.Set("Server","N/A");
}

Remove response Server header on Azure Web App from the first redirect request to HTTPS

1 Answers