.NET IIS7 can't remove X-AspNetMvc-Version header?

Question

I have tried all of the following ways below to remove the 'X-AspNetMvc-Version' header but it still appears? (X-AspNetMvc-Version: 5.2)

IIS doesn't have any headers added. Could there be something else that is conflicting with the header causing it to still be shown?

Any help is much appreciated. Thanks in advance.

web.config

<httpRuntime requestValidationMode="2.0" enableVersionHeader="false" targetFramework="4.5" maxRequestLength="1048576" />

Global.asax.cs - (attempt 1)

MvcHandler.DisableMvcResponseHeader = true;

Global.asax.cs - (attempt 2)

protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
    HttpContext.Current.Response.Headers.Remove("X-AspNetMvc-Version");
}

Global.asax.cs - (attempt 3)

protected void Application_BeginRequest(object sender, EventArgs e)
{
    var application = sender as HttpApplication;
    if (application != null && application.Context != null)
    {
        application.Context.Response.Headers.Remove("X-AspNetMvc-Version");
    }
}

Here is the full Global.asax.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Http;
using System.Web.Mvc;
using System.Web.Routing;

namespace website
{

    public class MvcApplication : System.Web.HttpApplication
    {
        protected void Application_Start()
        {
            AreaRegistration.RegisterAllAreas();

            WebApiConfig.Register(GlobalConfiguration.Configuration);
            FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
            RouteConfig.RegisterRoutes(RouteTable.Routes);

            MvcHandler.DisableMvcResponseHeader = true; 
        }
    }
}

method1 is just my internal reference it doesn't appear in the code. — ianhman, Jul 17 '17 at 13:41
Please include your complete `Global.asax.cs` source code. Is this issue occurring locally or on a separate server? — mjwills, Jul 17 '17 at 13:49
I have added the full Global.asax.cs code to original question. — ianhman, Jul 17 '17 at 14:03
Are you using .NET 4.5.2 (or newer)? If so you'll need to hook into Response.AddOnSendingHeaders in your Application_BeginRequest method in Global.asax.cs — John Bindel, Jul 17 '17 at 15:18
@jonh-bindel I tried this https://stackoverflow.com/questions/3418557/how-to-remove-asp-net-mvc-default-http-headers/#answer-34916778 but I get errors when trying to build. It doesn't recognise Response.AddOnSendingHeaders ? — ianhman, Jul 17 '17 at 15:42

score 2 · Answer 1 · answered Dec 09 '17 at 21:18

I had the same problem when publishing my website.

The only thing that resolved my issue was adding this code in the Global.asax.cs:

protected void Application_BeginRequest(object sender, EventArgs e)
{
      string[] headers = { "Server", "X-AspNetMvc-Version" };
      if (!Response.HeadersWritten)
      {
        Response.AddOnSendingHeaders((c) =>
            {
                if (c != null && c.Response != null && c.Response.Headers != null)
                {
                    foreach (string header in headers)
                    {
                        if (c.Response.Headers[header] != null)
                        {
                            c.Response.Headers.Remove(header);
                        }
                    }
                }
            });
        }

}

Note: this removes X-AspNetMvc-Version and Server headers.

not sure what this is doing, but it certainly works. it saved me after HOURS of dealing with this ugly crap. +1 — luiggig, Jan 31 '19 at 22:08

.NET IIS7 can't remove X-AspNetMvc-Version header?

1 Answers1