Server / X-Powered-By headers not available in runtime

Question

The "Server" and "X-Powered-By" headers are not present in the API response during runtime (or debugging) but appearing only on Postman / browser. My objective is to remove to Server/powered-by headers but they are not available during runtime for removal. API is based on ASP.NET Core 6.

Screenshot of response headers during runtime:

Screenshot of response headers in Postman

Is it only in debug or both? – hamaronooo Mar 14 '23 at 06:12 — hamaronooo, Mar 14 '23 at 06:12

score 1 · Accepted Answer · answered Mar 14 '23 at 09:16

They not appear because these 2 header are added outside runtime as the response go through IIS or IISexpress. If you publish the app and depoly to IIS, you can remove them by modify the webconfig.

<configuration>
<system.webServer>
        <httpProtocol>
            <customHeaders>
                <remove name="X-Powered-By" />
            </customHeaders>
        </httpProtocol>
        <security>
            <requestFiltering removeServerHeader="true" />
        </security>
    </system.webServer>
</configuration>

For debugging with IIS express. You can change the related settings in applicationhost.config which loacate at projectfolder-->.vs(hidden)-->config-->applicationhost.config.

score 0 · Answer 2 · answered Mar 14 '23 at 06:16

According to this:

PROCEDURE

Open IIS Manager.
Connect to the local server
Select the Default Web Site. 4.Double-click HTTP Response Headers. Select X-Powered-By. Click Remove.
Click Yes when prompted to confirm the change. For NuGenesis versions 9.1+:
Repeat steps 4 through 7 for the two sites "AuditTrailClientApp" and "AuditTrailWebServer".
Click on the local server entry.
Double-click Configuration Editor. Select the section "system.webServer/proxy".
Set "arrResponseHeader" to False. Click Apply.
Restart the web server.

Server / X-Powered-By headers not available in runtime

2 Answers2