4

I'm trying to stop MS Azure responding with the header/value of Server: HTTPAPI/2.0 on receipt of an invalid request, for example an invalid hostname.

I've seen this SO entry...

Removing Server and X-Powered-By HTTP Headers on Azure Web Site Preview

..and one answer suggests that the only way to get around this is to host the website on an Azure VM, something I'd much rather avoid.

It's 3.5 years on from that question/answer - does anyone know if it can now be suppressed in a WebApp solution

Community
  • 1
  • 1
CResults
  • 5,100
  • 1
  • 22
  • 28

2 Answers2

1

According the description at Remove standard server headers in Azure Web Sites:

HTTP headers are part of the communication process between web servers and browsers, and are included in the request and response. One example is the server header, which lists the product name and version of the web server (e.g., Microsoft-IIS/8.0). All web servers generate these headers, but now you can disable them on Azure Web Sites.

You can try to modify or create a new web.config in the root directory of your application on Azure Web Apps, with following content:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>
            <requestFiltering removeServerHeader="true" />
        </security>
    </system.webServer>
</configuration>

Please refer to https://azure.microsoft.com/en-us/blog/removing-standard-server-headers-on-windows-azure-web-sites/ for more info.

Gary Liu
  • 13,758
  • 1
  • 17
  • 32
  • Hi @Gary Liu. thanks - yep, I'm already successfully doing this along with removing X-Powered-By within the customHeaders element of web.config. I'm guessing I'm seeing this header as its produced by a service / handler that activates before my code/site? – CResults Jul 12 '16 at 09:20
  • I don't think you can remove that header since it comes from HTTP.SYS rather than IIS. This blog post does say it's possible to remove it, however you need to edit the registry, something you can't do on App Service - https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/ – evilSnobu Jul 27 '16 at 19:55
0

To remove the MVC header, add this in Global.asax - Application Start event:

MvcHandler.DisableMvcResponseHeader = true;

Using this will remove the version headers,

<httpRuntime enableVersionHeader="false" />

Thennarasan
  • 698
  • 6
  • 11