A couple of questions about response headers Server and X-Powered-By

[guardrex]

Out of the box, Server and X-Powered-By headers are added to responses ...

Server:Microsoft-IIS/10.0
X-Powered-By:ASP.NET

I tried using an ActionFilterAttribute to dump them ...

public class RemoveHeadersAttribute : ActionFilterAttribute {
    public override void OnActionExecuted(ActionExecutedContext filterContext) {
        filterContext.HttpContext.Response.Headers.Remove("Server");
        filterContext.HttpContext.Response.Headers.Remove("X-Powered-By");
        base.OnActionExecuted(filterContext);
    }
}

... but only the Server header was removed. Is the X-Powered-By header added later in the pipeline? Can it be removed? btw--- Why are these added anyway ... to help MS (others?) track server and programming technology used on the Net?

[guardrex]

Nevermind ... looks like the X-Powered-By header is being added by IIS Express. In IIS, the header doesn't appear (due to my manually removing it in the IIS Mgmt Console).

[guardrex]

On the Community Standup 8/18, @DamianEdwards wasn't sure how the framework can interact with the Server header, vis-a-vis removing it, because it might be server-added after the pipeline is done with the response. I think X-Powered-By is server-added ... I couldn't remove that one with the approach above or below (I've manually deleted that one in IIS in the past). I did have luck removing the Server header with the ActionFilterAttribute (above) on IIS Express. For a more global approach, @DamianEdwards recommended using middleware instead. According to Fiddler, I just had success with ...

public void Configure(IApplicationBuilder app) {
    app.Use(next => 
    {
        return ctx => 
        {
            ctx.Response.Headers.Remove("Server");
            return next(ctx);
        };
    });
    app.UseMvc();
}

I haven't tested on IIS yet, so I don't know if either approach is going to work. If it does work on IIS, does this look wrong/bad to anyone?

[DamianEdwards]

It's entirely possible that our IIS module that boots the DNX and ASP.NET 5 interacts with the headers dictionary in such a way that it allows you to remove the server header. Best way to know is to just try it.

[guardrex]

Seems you can remove Server both ways, but I'm glad you said something about using middleware. That's much better.

X-Powered-By seems to be added after the pipeline by the server for sure. Neither of these methods will drop that one. That one shows up in a vanilla IIS installation, and I've had to manually delete it in the past in the IIS Mgmt Console.