OWIN Change Response Server Identity?

Question

I have a simple OWIN Middleware at the end of a chain, and I am setting the Server header value like this:

myiowincontext.Response.Headers.Remove("Server");
myiowincontext.Response.Headers.Set("Server" ,"owin");
return myiowincontext.Response.WriteAsync( "hello world" );

But that appears to only change the header from

Server: Microsoft-HTTPAPI/2.0

to

Server: owin Microsoft-HTTPAPI/2.0`

What is the proper way to set the Server header value to something custom, without including the "Microsoft-HTTPAPI/2.0" part?

Thanks.

score 2 · Accepted Answer · edited May 23 '17 at 12:17

This header is inserted by HTTP.SYS on the outgoing responses. Since HTTP.SYS sees you already have a Server header on your response, it simply appends it. To remove the default server header inserted by HTTP.SYS I see some registry key suggestions here. But it did not work for me though some people have told it works for them. Try your luck. This post suggests that removing this key does not improve the security in any way - so the solution to remove the key was removed. Another suggestion that many posts suggest is using UrlScan.

OWIN Change Response Server Identity?

1 Answers1