Removing/Hiding/Disabling excessive HTTP response headers in Azure/IIS7 without UrlScan
Removing/Hiding/Disabling excessive HTTP response headers in Azure/IIS7 without UrlScan
Removing/Hiding/Disabling excessive HTTP response headers in Azure/IIS7 without UrlScan
Re: Removing/Hiding/Disabling excessive HTTP response headers in Azure/IIS7 without UrlScan
The following changes allow you to remove these HTTP response headers in Azure *without* writing a custom HttpModule.
Most of the information on the net is out of date, and involves UrlScan (which has since been integrated into IIS7, but with the `RemoveServerHeader=1` option removed). Below is the neatest solution I've found (thanks to [this blog](http://www.davidaiken.com/2011/10/04/hiding-response-headers/), [this answer](https://stackoverflow.com/a/7338448/590558), and [this blog](http://www.bugwriter.me/2010/01/removing-unnecessary-http-header-server.html) combined).
To remove **Server**, go to Global.asax, find/create the `Application_PreSendRequestHeaders` event and add the following (thanks to [BK](https://stackoverflow.com/a/7338448/590558) and [this blog](http://www.bugwriter.me/2010/01/removing-unnecessary-http-header-server.html) this will also not fail on Cassini / local dev):
Edited April 2014: You can use the PreSendRequestHeaders and PreSendRequestContext events with native IIS modules, but do not use them with managed modules that implement IHttpModule. Setting these properties can cause issues with [asynchronous requests](http://www.asp.net/aspnet/overview/web-development-best-practices/what-not-to-do-in-aspnet,-and-what-to-do-instead#presend). The correct version is to use BeginRequest event.
```
protected void Application_BeginRequest(object sender, EventArgs e)
{
var application = sender as HttpApplication;
if (application != null && application.Context != null)
{
application.Context.Response.Headers.Remove("Server");
}
}
```
To remove **X-AspNet-Version**, in the web.config find/create `` and add:
```
...
```
To remove **X-AspNetMvc-Version**, go to Global.asax, find/create the `Application_Start` event and add a line as follows:
```
protected void Application_Start()
{
MvcHandler.DisableMvc
*(Réponse tronquée)*
Most of the information on the net is out of date, and involves UrlScan (which has since been integrated into IIS7, but with the `RemoveServerHeader=1` option removed). Below is the neatest solution I've found (thanks to [this blog](http://www.davidaiken.com/2011/10/04/hiding-response-headers/), [this answer](https://stackoverflow.com/a/7338448/590558), and [this blog](http://www.bugwriter.me/2010/01/removing-unnecessary-http-header-server.html) combined).
To remove **Server**, go to Global.asax, find/create the `Application_PreSendRequestHeaders` event and add the following (thanks to [BK](https://stackoverflow.com/a/7338448/590558) and [this blog](http://www.bugwriter.me/2010/01/removing-unnecessary-http-header-server.html) this will also not fail on Cassini / local dev):
Edited April 2014: You can use the PreSendRequestHeaders and PreSendRequestContext events with native IIS modules, but do not use them with managed modules that implement IHttpModule. Setting these properties can cause issues with [asynchronous requests](http://www.asp.net/aspnet/overview/web-development-best-practices/what-not-to-do-in-aspnet,-and-what-to-do-instead#presend). The correct version is to use BeginRequest event.
```
protected void Application_BeginRequest(object sender, EventArgs e)
{
var application = sender as HttpApplication;
if (application != null && application.Context != null)
{
application.Context.Response.Headers.Remove("Server");
}
}
```
To remove **X-AspNet-Version**, in the web.config find/create `` and add:
```
...
```
To remove **X-AspNetMvc-Version**, go to Global.asax, find/create the `Application_Start` event and add a line as follows:
```
protected void Application_Start()
{
MvcHandler.DisableMvc
*(Réponse tronquée)*