IIS 10: Remove headers not working

[Guest /u/ku4eto]

Hey folks.

 

Server 2022 Standard with IIS 10.

 

Application is a ASP .NET 4.8 basd, running with [iCODE]Integrated mode[/iCODE] and [iCODE]Application Pool Identity[/iCODE].

 

Im trying to remove the following headers:

 

[iCODE]Server , X-Powered-By, X-ASPNet-Version, X-ASPNetMVC-Version[/iCODE]

 

No matter what i do, they simply REFUSE to be removed.

 

Things i did:

 

1. 
   Remove on server level from [iCODE]RESPONSE HEADERS[/iCODE] the [iCODE]X-Powered-By[/iCODE] header - no effect, still shows up on dynamic content.
    
    
   
2. 
   Set on server level [iCODE]system.web/httpRuntime -> enableVersionHeader[/iCODE] to False - no effect, still shows up.
    
    
   
3. 
   Set on server level [iCODE]system.webServer/security/requestFiltering -> removeServerHeader[/iCODE] to True - no effect, still shows up with full value.
    
    
   
4. 
   Set the registry key at [iCODE]HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters[/iCODE] with the DWORD [iCODE]DisableServerHeader[/iCODE] to 1 - Restarted IIS, no effect.
    
   

 

I confirmed, that the changes on server level go down to the website level. I tried setting it up also manually in the web.config on the site. Same effect (none).

 

URL Scan is no longer available, so it is not an option. Last option seems to be to use URL Rewrite, but i would rather not use it if possible, given there are supposedly native solutions for that.

 

submitted by /u/ku4eto

[link] [comments]

 

Continue reading...