Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Comment supprimer les en-têtes de réponse IIS/ASP.NET

ayi

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information through response headers. I have removed all the HTTP-HEADERS out of the IIS configuration for the website (X-Powered-By or some such header).
(I personally do know that this information can be easily found out, even if it is hidden, but it isn’t my call.)
Headers I want to remove:
<ul>
<li>
Server - Microsoft-IIS/6.0
</li>
<li>
X-AspNet-Version - 2.0.50727
</li>
</ul>
I also know that <a href="http://ASP.NET" rel="noopener nofollow ugc">ASP.NET</a> MVC also emits its own header too, if you know how to remove it also, that would be helpful.
<ul>
<li>X-AspNetMvc-Version - 1.0</li>
</ul>
<hr>
Source : <a href="https://docs.microsoft.com/en-us/iis/extensions/working-with-urlscan/urlscan-3-reference" rel="noopener nofollow ugc">Server Fault</a>

ayi_2

Your security department wants you to do this to make the server type harder to identify. This may lessen the barrage of automated hacking tools and make it more difficult for people to break into the server.
Within IIS, open the web site properties, then go to the HTTP Headers tab. Most of the X- headers can be found and removed here. This can be done for individual sites, or for the entire server (modify the properties for the Web Sites object in the tree).
For the Server header, on IIS6 you can use Microsoft’s <a href="https://docs.microsoft.com/en-us/iis/extensions/working-with-urlscan/urlscan-3-reference">URLScan</a> tool to remote that. Port 80 Software also makes a product called <a href="http://www.port80software.com/products/servermask/">ServerMask</a> that will take care of that, and a lot more, for you.
For IIS7 (and higher), you can use the <a href="https://www.iis.net/downloads/microsoft/url-rewrite">URL Rewrite Module</a> to rewrite the server header or blank it’s value. In web.config (at a site or the server as a whole), add this content after the URL Rewrite Module has been installed:
<pre><code class="lang-auto"><rewrite>
<outboundRules rewriteBeforeCache="true">
<rule name="Remove Server header">
<match serverVariable="RESPONSE_Server" pattern=".+" />
<action type="Rewrite" value="" />
</rule>
</outboundRules>
</rewrite>

</code></pre>
You can put a custom value into the rewrite action if you’d like. This sample sourced from <a href="https://www.saotn.org/remove-iis-server-version-http-response-header/">this article</a> which also has other great information.
For the MVC header, in Global.asax:
<pre><code class="lang-auto">MvcHandler.DisableMvcResponseHeader = true;

</code></pre>
Edited 11-12-2019 to update the IIS7 info since the TechNet blog link was no longer valid.