如何删除ASP.Net MVC默认HTTP标头？

Question

我正在使用的MVC应用程序中的每个页面都在响应中设置这些HTTP标头:

X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 2.0

如何防止这些显示？

Answer 1

"powered by"是IIS中的自定义标头.更改它取决于您使用的IIS版本.有关如何修改或删除的一些信息,请参阅此处:

http://www.iis.net/ConfigReference/system.webServer/httpProtocol/customHeaders

要删除MVC标头,

在Global.asax中,在Application Start事件中:

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

把它放在web.config中去掉X-AspNet-Version标题:

<system.web>
  <httpRuntime enableVersionHeader="false" />
</system.web>

Answer 2

您还可以通过向global.asax文件添加代码来删除它们:

 protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
 {
   HttpContext.Current.Response.Headers.Remove("X-Powered-By");
   HttpContext.Current.Response.Headers.Remove("X-AspNet-Version");
   HttpContext.Current.Response.Headers.Remove("X-AspNetMvc-Version");
   HttpContext.Current.Response.Headers.Remove("Server");
 }

Answer 3

我发现这个配置web.config是New Web Site...在Visual Studio中创建的(而不是a New Project...).由于问题陈述了一个ASP.NET MVC应用程序,不是相关的,但仍然是一个选项.

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <clear />
      <remove name="X-Powered-By" />
    </customHeaders>
   </httpProtocol>
</system.webServer>

更新:另外,Troy Hunt有一篇题为Shhh的文章...不要让你的响应标题过于响亮,有关删除这些标题的详细步骤以及用于扫描它们和其他安全配置的ASafaWeb工具的链接.

Answer 4

如在IIS 7上隐藏ASP.NET MVC Web应用程序中所述,您可以通过将以下配置部分应用于web.config来关闭X-AspNet-Version标头:

<system.web> 
  <httpRuntime enableVersionHeader="false"/> 
</system.web>

并通过更改Global.asax.cs删除X-AspNetMvc-Version标头,如下所示:

protected void Application_Start() 
{ 
    MvcHandler.DisableMvcResponseHeader = true; 
}

如自定义标题中所述您可以通过将以下配置部分应用于web.config来删除"X-Powered-By"标题:

<system.webServer>
   <httpProtocol>
      <customHeaders>
         <clear />
      </customHeaders>
   </httpProtocol>
</system.webServer>

没有简单的方法可以通过配置删除"服务器"响应标头,但是您可以实现HttpModule删除特定的HTTP标头,如在IIS 7上隐藏ASP.NET MVC Web应用程序和如何删除服务器中所述 - x-aspnet-version-x-aspnetmvc-version-and-x-powered-from-the-response-header-in-iis7.

Answer 5

.NET核心

要删除Server.cs文件中的Server标头,请添加以下选项:

.UseKestrel(opt => opt.AddServerHeader = false)

对于dot net core 1,put在.UseKestrel()调用中添加选项.对于dot net core 2,在UseStartup()之后添加该行.

要删除X-Powered-By标头,如果部署到IIS,请编辑web.config并在system.webServer标记内添加以下部分:

<httpProtocol>
    <customHeaders>
        <remove name="X-Powered-By" />
    </customHeaders>
</httpProtocol>

.NET 4.5.2

要删除Server标头,请在global.asax文件中添加以下内容:

    protected void Application_BeginRequest(object sender, EventArgs e)
    {
        string[] headers = { "Server", "X-AspNet-Version" };

        if (!Response.HeadersWritten)
        {
            Response.AddOnSendingHeaders((c) =>
            {
                if (c != null && c.Response != null && c.Response.Headers != null)
                {
                    foreach (string header in headers)
                    {
                        if (c.Response.Headers[header] != null)
                        {
                            c.Response.Headers.Remove(header);
                        }
                    }
                }
            });
        }

    }

Pre .NET 4.5.2

将以下c#类添加到项目中:

public class RemoveServerHeaderModule : IHttpModule
{
    public void Init(HttpApplication context)
    {
        context.PreSendRequestHeaders += OnPreSendRequestHeaders;
    }

    public void Dispose() { }

    void OnPreSendRequestHeaders(object sender, EventArgs e)
    {
        HttpContext.Current.Response.Headers.Remove("Server");
    }
}

然后在你的web.config中添加以下<modules>部分:

<system.webServer>
    ....
 <modules>
    <add name="RemoveServerHeaderModule" type="MyNamespace.RemoveServerHeaderModule" />
 </modules>

但是我遇到了子项目找不到这个模块的问题.不好玩.

删除X-AspNetMvc-Version标头

要删除"X-AspNetMvc-Version"标记,对于任何版本的.NET,请修改"web.config"文件以包含:

<system.web>
...
   <httpRuntime enableVersionHeader="false" />
...
</system.web>

感谢微软让这难以置信的困难.或者也许这是你的意图,以便你可以跟踪世界各地的IIS和MVC安装......

Answer 6

如" 在Windows Azure网站上删除标准服务器标头"页面上所示,您可以使用以下内容删除标头:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <clear />
      </customHeaders>
    </httpProtocol>
    <security>
      <requestFiltering removeServerHeader="true"/>
    </security>
  </system.webServer>
  <system.web>
    <httpRuntime enableVersionHeader="false" />
  </system.web>
</configuration>

这将删除Server标头和X-header.

这在我的Visual Studio 2015测试中本地工作.

Answer 7

在Asp.Net Core中,您可以编辑web.config文件,如下所示:

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By" />
  </customHeaders>
</httpProtocol>

您可以删除Kestrel选项中的服务器标头:

            .UseKestrel(c =>
            {
                // removes the server header
                c.AddServerHeader = false;
            }) 

Answer 8

检查此博客 不要使用代码删除标题。根据微软的说法它是不稳定的

我对此的看法：

<system.webServer>          
    <httpProtocol>
    <!-- Security Hardening of HTTP response headers -->
    <customHeaders>
        <!--Sending the new X-Content-Type-Options response header with the value 'nosniff' will prevent 
                Internet Explorer from MIME-sniffing a response away from the declared content-type. -->
        <add name="X-Content-Type-Options" value="nosniff" />

        <!-- X-Frame-Options tells the browser whether you want to allow your site to be framed or not. 
                 By preventing a browser from framing your site you can defend against attacks like clickjacking. 
                 Recommended value "x-frame-options: SAMEORIGIN" -->
        <add name="X-Frame-Options" value="SAMEORIGIN" />

        <!-- Setting X-Permitted-Cross-Domain-Policies header to “master-only” will instruct Flash and PDF files that 
                 they should only read the master crossdomain.xml file from the root of the website. 
                 https://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html -->
        <add name="X-Permitted-Cross-Domain-Policies" value="master-only" />

        <!-- X-XSS-Protection sets the configuration for the cross-site scripting filter built into most browsers. 
                 Recommended value "X-XSS-Protection: 1; mode=block". -->
        <add name="X-Xss-Protection" value="1; mode=block" />

        <!-- Referrer-Policy allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. 
                 If you have sensitive information in your URLs, you don't want to forward to other domains 
                 https://scotthelme.co.uk/a-new-security-header-referrer-policy/ -->
        <add name="Referrer-Policy" value="no-referrer-when-downgrade" />

        <!-- Remove x-powered-by in the response header, required by OWASP A5:2017 - Do not disclose web server configuration -->
        <remove name="X-Powered-By" />

        <!-- Ensure the cache-control is public, some browser won't set expiration without that  -->
        <add name="Cache-Control" value="public" />
    </customHeaders>
</httpProtocol>

<!-- Prerequisite for the <rewrite> section
            Install the URL Rewrite Module on the Web Server https://www.iis.net/downloads/microsoft/url-rewrite -->
<rewrite>
    <!-- Remove Server response headers (OWASP Security Measure) -->
    <outboundRules rewriteBeforeCache="true">
        <rule name="Remove Server header">
            <match serverVariable="RESPONSE_Server" pattern=".+" />

            <!-- Use custom value for the Server info -->
            <action type="Rewrite" value="Your Custom Value Here." />
        </rule>
    </outboundRules>
</rewrite>
</system.webServer>