0

We are trying to remove Server identity header from API response. We have added rewrite rules in global web.config and application web.config and is working properly, But now when we change method type to "Trace" and change "Content-Length" value to grater than 0 it is giving 400 error.

At this time server is raveling Server header in response : Server:Microsoft-HTTPAPI/2.0 We identified that request is not reaching to server web config or inside application.

Server : Windows server 2019 - IIS10

Anyone can suggest us about how to remove that header from response ? We already tried registry value change fix but not working.

Chetan Patel
  • 1
  • 1
  • 1

1 Answers1

0

Could you find the failed rquest in IIS log? If not, what error message did you see in http C:\Windows\System32\LogFiles\HTTPERR?

When you are receiving Response Server:HTTP-API/2.0. Then it means the header is not added by IIS pipeline.

You could only remove it by adding a DWORD DisableServerHeader=1 in HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters.

Please remember to reboot server after changing this registry key to make it work!

https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/

Jokies Ding
  • 3,374
  • 1
  • 5
  • 10
  • Thank you! we did change "DisableServerHeader" from Registry but did not work but after instillation "URLScan" it's working fine. – Chetan Patel Nov 26 '19 at 12:49