question

lzandman-2012 avatar image
0 Votes"
lzandman-2012 asked ContrerasJohn-1869 commented

Remove HTTP Server header for HTTP 1.0 requests

We host some of our .Net web apps in an Azure Web App on a shared plan. A security audit showed that in certain cases the HTTP Server header is returned, identifying the server running "Microsoft-IIS/10.0". We are already using the "removeServerHeader" attribute set to “true” in web.config. Also we are using the customHeaders remove elements to remove certain headers. So in most cases no Server header gets sent.

However, there is a specific case where the Server header is sent: when requesting it using a HTTP 1.0 request. When I open a Telnet connection to port 80 of my web app and send the following GET request:

GET / HTTP/1.0

I get the following response:

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/10.0
Date: Tue, 06 Oct 2020 13:47:22 GMT
Connection: close
Content-Length: 2778

Can this be prevented?

azure-webapps
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

sadomovalex avatar image
0 Votes"
sadomovalex answered lzandman-2012 commented

removeServerHeader" attribute set to false in web.config

shouldn't it be set to true if you don't want to send Server header?

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Yeah, sorry. That’s a typo. We’ve set it to the proper value. But as I said, the problem happens outside of our web app, so web.config has no effect.

0 Votes 0 ·
Dave-1 avatar image
0 Votes"
Dave-1 answered ContrerasJohn-1869 commented

Sorry for my delayed response here but I feel that this question deserves a good answer.

One way that I can think of is to have this use system.webServer rather than system.web which is application specific. I've tested this on a normal html file and it works as expected. Let me know if this works for you.

 <?xml version="1.0" encoding="UTF-8"?>
 <configuration>
     <system.webServer>
         <security>
             <requestFiltering removeServerHeader ="true" />
         </security>
     </system.webServer>
 </configuration>




· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

So, I have the same problem and I already have this configuration on my web.config, but the problem persists, because, the issue is related to the HTTP protocol version, specifically the 1.0, the HTTP 1.1 is what IIS uses by default, but the problem comes with the HTTP 1.0. So, this answer only works for the HTTP 1.1.

0 Votes 0 ·