Skip to main content

How to hide ‘Server’ and ‘X-Powered-By’ headers in ASP.NET Core

As we see security as a top priority, for every new application that we put in production, we let it be penetration tested first. One remark we got with the last pen test was about the information our servers inadvertently revealed through HTTP response headers. Although I think it is not the biggest possible security issue, exposing details about their technology stack through headers like Server and X-Powered-By, gives some reconnaissance information to potential attackers for free.

n this post, we'll explore why you should hide these headers and demonstrate several methods to remove or customize them in ASP.NET Core applications.

Generated with Bing Image Creator

Why hide server headers?

Server identification headers might seem harmless, but they can pose security risks:

Information Disclosure: Headers like Server: Kestrel or X-Powered-By: ASP.NET immediately tell attackers what technology stack you're using, making it easier for them to target known vulnerabilities.

Reconnaissance: Attackers often perform reconnaissance by scanning for specific server signatures to identify potential targets running vulnerable versions of software.

Security through obscurity: While not a primary security measure, hiding server information adds an extra layer of obscurity that can deter automated attacks and script kiddies.

Removing these headers in ASP.NET Core

Turns out that it not so simple to remove these headers from your ASP.NET Core application. Our first naive attempt was through a custom middleware:

However it turned out that this didn’t work and both headers were still there.

Some further research brought us to 2 solutions that work as expected. Depending on the hosting platform(Kestrel vs IIS) choose one or the other:

Remove 'Server' header when using Kestrel

You can configure Kestrel to not add the Server header at all by modifying the server options:

Remove 'Server' header and 'X-Powered-By' header when using IIS

When hosting on IIS, you'll need to configure the web.config file to remove IIS-specific headers:

Labels:

Popular posts from this blog

.NET 8–Keyed/Named Services

A feature that a lot of IoC container libraries support but that was missing in the default DI container provided by Microsoft is the support for Keyed or Named Services. This feature allows you to register the same type multiple times using different names, allowing you to resolve a specific instance based on the circumstances. Although there is some controversy if supporting this feature is a good idea or not, it certainly can be handy. To support this feature a new interface IKeyedServiceProvider got introduced in .NET 8 providing 2 new methods on our ServiceProvider instance: object? GetKeyedService(Type serviceType, object? serviceKey); object GetRequiredKeyedService(Type serviceType, object? serviceKey); To use it, we need to register our service using one of the new extension methods: Resolving the service can be done either through the FromKeyedServices attribute: or by injecting the IKeyedServiceProvider interface and calling the GetRequiredKeyedServic...
Read more

Azure DevOps/ GitHub emoji

I’m really bad at remembering emoji’s. So here is cheat sheet with all emoji’s that can be used in tools that support the github emoji markdown markup: All credits go to rcaviers who created this list.
Read more

Kubernetes–Limit your environmental impact

Reducing the carbon footprint and CO2 emission of our (cloud) workloads, is a responsibility of all of us. If you are running a Kubernetes cluster, have a look at Kube-Green . kube-green is a simple Kubernetes operator that automatically shuts down (some of) your pods when you don't need them. A single pod produces about 11 Kg CO2eq per year( here the calculation). Reason enough to give it a try! Installing kube-green in your cluster The easiest way to install the operator in your cluster is through kubectl. We first need to install a cert-manager: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.yaml Remark: Wait a minute before you continue as it can take some time before the cert-manager is up & running inside your cluster. Now we can install the kube-green operator: kubectl apply -f https://github.com/kube-green/kube-green/releases/latest/download/kube-green.yaml Now in the namespace where we want t...
Read more