我正在处理的MVC应用程序中,每个页面都会在响应中设置以下HTTP头:
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 2.0
我该如何防止它们显示出来?
我正在处理的MVC应用程序中,每个页面都会在响应中设置以下HTTP头:
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 2.0
我该如何防止它们显示出来?
X-Powered-By
是IIS中的自定义标头。自IIS 7以来,您可以通过将以下内容添加到web.config
文件中来删除它:
<httpProtocol>
<customHeaders>
<clear />
</customHeaders>
</httpProtocol>
请注意,这将删除所有自定义标头。
<system.webServer>
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
</customHeaders>
</httpProtocol>
</system.webServer>
这个头部也可以根据您的需要进行修改,有关更多信息,请参阅http://www.iis.net/ConfigReference/system.webServer/httpProtocol/customHeaders
将以下内容添加到web.config
中以去除X-AspNet-Version
头部:
<system.web>
<httpRuntime enableVersionHeader="false" />
</system.web>
最后,要删除 X-AspNetMvc-Version
,请编辑 Global.asax.cs
并在 Application_Start
事件中添加以下代码:
protected void Application_Start()
{
MvcHandler.DisableMvcResponseHeader = true;
}
你还可以通过 Global.asax.cs
中的 Application_PreSendRequestHeaders
事件在运行时修改标题。如果你的标题值是动态的,则这非常有用:protected void Application_PreSendRequestHeaders(object source, EventArgs e)
{
Response.Headers.Remove("foo");
Response.Headers.Add("bar", "quux");
}
X-Powered-By
头信息。请参考其他答案以了解如何在 web.config
中实现此操作。 - Knelis protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
HttpContext.Current.Response.Headers.Remove("X-Powered-By");
HttpContext.Current.Response.Headers.Remove("X-AspNet-Version");
HttpContext.Current.Response.Headers.Remove("X-AspNetMvc-Version");
HttpContext.Current.Response.Headers.Remove("Server");
}
<system.webServer><httpProtocol><customHeaders><remove name="X-Powered-By" /></customHeaders><redirectHeaders><clear /></redirectHeaders></httpProtocol></system.webServer>
。 - Frank van Eykelen我在web.config
中找到了这个配置,它是为Visual Studio创建的一个New Web Site...
而设计的(与New Project...
相对)。虽然问题是关于ASP.NET MVC应用程序的,但这仍然是一个选项。
<system.webServer>
<httpProtocol>
<customHeaders>
<clear />
<remove name="X-Powered-By" />
</customHeaders>
</httpProtocol>
</system.webServer>
更新: 此外,Troy Hunt有一篇文章标题为“嘘...不要让你的响应头太吵闹”,详细介绍了如何删除这些头文件,以及他的ASafaWeb工具用于扫描它们和其他安全配置。.NET Core
为了移除Server响应头,在Program.cs文件中添加以下选项:
.UseKestrel(opt => opt.AddServerHeader = false)
对于 dot net core 1,在 .UseKestrel() 调用内添加选项。对于 dot net core 2,在 UseStartup() 后添加该行。
如果部署到 IIS 并要删除 X-Powered-By 标头,请编辑您的 web.config 文件,并在 system.webServer 标记内添加以下部分:
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
</customHeaders>
</httpProtocol>
.NET 4.5.2
为了移除Server头信息,您需要在您的global.asax文件中添加以下内容:
protected void Application_BeginRequest(object sender, EventArgs e)
{
string[] headers = { "Server", "X-AspNet-Version" };
if (!Response.HeadersWritten)
{
Response.AddOnSendingHeaders((c) =>
{
if (c != null && c.Response != null && c.Response.Headers != null)
{
foreach (string header in headers)
{
if (c.Response.Headers[header] != null)
{
c.Response.Headers.Remove(header);
}
}
}
});
}
}
早于 .NET 4.5.2 版本
将以下 C# 类添加到您的项目中:
public class RemoveServerHeaderModule : IHttpModule
{
public void Init(HttpApplication context)
{
context.PreSendRequestHeaders += OnPreSendRequestHeaders;
}
public void Dispose() { }
void OnPreSendRequestHeaders(object sender, EventArgs e)
{
HttpContext.Current.Response.Headers.Remove("Server");
}
}
然后在你的web.config中添加以下<modules>部分:
<system.webServer>
....
<modules>
<add name="RemoveServerHeaderModule" type="MyNamespace.RemoveServerHeaderModule" />
</modules>
然而,我遇到了一个问题,子项目无法找到这个模块。不好玩。
要移除任何 .NET 版本的 ''X-AspNetMvc-Version'' 标签,请修改您的 ''web.config'' 文件以包含:
<system.web>
...
<httpRuntime enableVersionHeader="false" />
...
</system.web>
感谢微软让这变得难以置信的困难。也许这是你们的意图,以便可以跟踪全世界的IIS和MVC安装...
RemoveServerHeaderModule
,它在WebApi项目中不起作用。 - krypruX-AspNet-Version
头,而没有删除X-AspNetMvc-Version
头。 - Suncat2000如在IIS 7上隐藏您的ASP.NET MVC Web应用程序所述,您可以通过将以下配置部分应用于您的web.config文件来关闭X-AspNet-Version标头:
<system.web>
<httpRuntime enableVersionHeader="false"/>
</system.web>
通过更改Global.asax.cs文件,您可以删除X-AspNetMvc-Version头,方法如下:
protected void Application_Start()
{
MvcHandler.DisableMvcResponseHeader = true;
}
如自定义标头所述,您可以通过将以下配置部分应用于您的web.config来删除“X-Powered-By”标头:
<system.webServer>
<httpProtocol>
<customHeaders>
<clear />
</customHeaders>
</httpProtocol>
</system.webServer>
HttpModule
来删除特定的HTTP头,如在IIS 7上伪装ASP.NET MVC Web应用程序和如何从IIS7的响应头中删除Server、X-AspNet-Version、X-AspNetMvc-Version和X-Powered-By所述。如Windows Azure 网站上删除标准服务器标头页面所示,您可以使用以下方式删除标头:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
<httpProtocol>
<customHeaders>
<clear />
</customHeaders>
</httpProtocol>
<security>
<requestFiltering removeServerHeader="true"/>
</security>
</system.webServer>
<system.web>
<httpRuntime enableVersionHeader="false" />
</system.web>
</configuration>
这将移除服务器头(Server header)和 X- 头。
在我的 Visual Studio 2015 测试中本地运行良好。
其他参考资料:
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
</customHeaders>
</httpProtocol>
.UseKestrel(c =>
{
// removes the server header
c.AddServerHeader = false;
})
请查看这篇博客。
不要使用代码来删除头信息,因为根据Microsoft的说法,这是不稳定的。
我的建议是:
<system.webServer>
<httpProtocol>
<!-- Security Hardening of HTTP response headers -->
<customHeaders>
<!--Sending the new X-Content-Type-Options response header with the value 'nosniff' will prevent
Internet Explorer from MIME-sniffing a response away from the declared content-type. -->
<add name="X-Content-Type-Options" value="nosniff" />
<!-- X-Frame-Options tells the browser whether you want to allow your site to be framed or not.
By preventing a browser from framing your site you can defend against attacks like clickjacking.
Recommended value "x-frame-options: SAMEORIGIN" -->
<add name="X-Frame-Options" value="SAMEORIGIN" />
<!-- Setting X-Permitted-Cross-Domain-Policies header to “master-only” will instruct Flash and PDF files that
they should only read the master crossdomain.xml file from the root of the website.
https://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html -->
<add name="X-Permitted-Cross-Domain-Policies" value="master-only" />
<!-- X-XSS-Protection sets the configuration for the cross-site scripting filter built into most browsers.
Recommended value "X-XSS-Protection: 1; mode=block". -->
<add name="X-Xss-Protection" value="1; mode=block" />
<!-- Referrer-Policy allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
If you have sensitive information in your URLs, you don't want to forward to other domains
https://scotthelme.co.uk/a-new-security-header-referrer-policy/ -->
<add name="Referrer-Policy" value="no-referrer-when-downgrade" />
<!-- Remove x-powered-by in the response header, required by OWASP A5:2017 - Do not disclose web server configuration -->
<remove name="X-Powered-By" />
<!-- Ensure the cache-control is public, some browser won't set expiration without that -->
<add name="Cache-Control" value="public" />
</customHeaders>
</httpProtocol>
<!-- Prerequisite for the <rewrite> section
Install the URL Rewrite Module on the Web Server https://www.iis.net/downloads/microsoft/url-rewrite -->
<rewrite>
<!-- Remove Server response headers (OWASP Security Measure) -->
<outboundRules rewriteBeforeCache="true">
<rule name="Remove Server header">
<match serverVariable="RESPONSE_Server" pattern=".+" />
<!-- Use custom value for the Server info -->
<action type="Rewrite" value="Your Custom Value Here." />
</rule>
</outboundRules>
</rewrite>
</system.webServer>
X-AspNetMvc-Version
的方法是通过代码实现。 - Suncat2000Server
头。请参阅此MSDN博客。HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
我更希望找到一个适当的解决方案,使用Web.config不是好选择,因为它需要安装rewrite模块,即使安装了也不能真正删除头信息,只能将其清空。您可以在Application_EndRequest()
中更改任何标题或其他内容,请尝试以下操作
protected void Application_EndRequest()
{
// removing excessive headers. They don't need to see this.
Response.Headers.Remove("header_name");
}