J'ai a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information through response headers. J'ai removed tous le HTTP-HEADERS out of le IIS configuration for le website (X-Powered-By ou certains such header).
*(I personally do know that this information can be easily found out, even si it is hidden, mais it n'est pas mon call.)*
Headers Je veux to remove:
- **Server** - Microsoft-IIS/6.0
- **X-AspNet-Version** - 2.0.50727
I aussi know that ASP.NET MVC aussi emits its own header too, si you know how to remove it also, that would be helpful.
- **X-AspNetMvc-Version** - 1.0
Comment supprimer les en-têtes de réponse IIS/ASP.NET
Re: Comment supprimer les en-têtes de réponse IIS/ASP.NET
Your security department wants you to do this to make le server type harder to identify. This may lessen le barrage of automated hacking tools et make it more difficult for people to break into le server.
Within IIS, ouvrez le web site properties, alors allez dans le HTTP Headers tab. Most of le X- headers can be found et removed here. Cela peut be done for individual sites, ou for le entire server (modify le properties for le Web Sites object in le tree).
For le Server header, on IIS6 you can use Microsoft's [URLScan](https://docs.microsoft.com/en-us/iis/extensions/working-with-urlscan/urlscan-3-reference) tool to remote that. Port 80 Software aussi makes a product called [ServerMask](http://www.port80software.com/products/servermask/) that will take care of that, et a lot more, for you.
For IIS7 (and higher), you can use le [URL Rewrite Module](https://www.iis.net/downloads/microsoft/url-rewrite) to rewrite le server header ou blank c'est value. In web.config (at a site ou le server as a whole), add this content après le URL Rewrite Module has been installed:
```
```
Vous pouvez put a custom value into le rewrite action si you'd like. This sample sourced depuis [this article](https://www.saotn.org/remove-iis-server-version-http-response-header/) qui aussi has autre great information.
For le MVC header, in Global.asax:
```
MvcHandler.DisableMvcResponseHeader = true;
```
Edited 11-12-2019 to mettez à jour le IIS7 info depuis le TechNet blog link was no longer valid.
Within IIS, ouvrez le web site properties, alors allez dans le HTTP Headers tab. Most of le X- headers can be found et removed here. Cela peut be done for individual sites, ou for le entire server (modify le properties for le Web Sites object in le tree).
For le Server header, on IIS6 you can use Microsoft's [URLScan](https://docs.microsoft.com/en-us/iis/extensions/working-with-urlscan/urlscan-3-reference) tool to remote that. Port 80 Software aussi makes a product called [ServerMask](http://www.port80software.com/products/servermask/) that will take care of that, et a lot more, for you.
For IIS7 (and higher), you can use le [URL Rewrite Module](https://www.iis.net/downloads/microsoft/url-rewrite) to rewrite le server header ou blank c'est value. In web.config (at a site ou le server as a whole), add this content après le URL Rewrite Module has been installed:
```
```
Vous pouvez put a custom value into le rewrite action si you'd like. This sample sourced depuis [this article](https://www.saotn.org/remove-iis-server-version-http-response-header/) qui aussi has autre great information.
For le MVC header, in Global.asax:
```
MvcHandler.DisableMvcResponseHeader = true;
```
Edited 11-12-2019 to mettez à jour le IIS7 info depuis le TechNet blog link was no longer valid.