blocks|key|208650|text|在NuGet上还有一个包，它可以通过几行配置来帮助您实现这一点，并且不需要修改代码:+NWebsec。有关删除版本头的文档可在以下位置找到：https://github.com/NWebsec/NWebsec/wiki/Suppressing-version-headers|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|208651|在这里演示：http://www.nwebsec.com/HttpHeaders/VersionHeaders+(在Azure中)|208652|免责声明:我是这个项目的开发者。|208653|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/NWebsec/NWebsec/wiki/Suppressing-version-headers|1|http://www.nwebsec.com/HttpHeaders/VersionHeaders^0|1Y|1V|0|0|6|1D|1|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]]|C|$]]|$1|F|3|G|5|6|7|Z|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|10|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]|P|$5|K|L|M|C|$N|Q]]]]

There's also a package on NuGet that helps you achieve this through a few lines of config and no changes to code: NWebsec. The docs on removing version headers can be found here: <a href="https://github.com/NWebsec/NWebsec/wiki/Suppressing-version-headers" rel="nofollow noreferrer">https://github.com/NWebsec/NWebsec/wiki/Suppressing-version-headers</a>

It's demoed here: <a href="http://www.nwebsec.com/HttpHeaders/VersionHeaders" rel="nofollow noreferrer">http://www.nwebsec.com/HttpHeaders/VersionHeaders</a> (in Azure)

Disclaimer: I'm the developer on the project.

blocks|key|2851964|text|MSDN发布了关于如何在Azure网站上隐藏标题的this+article。现在，您可以通过将条目添加到system.webServer来对web.config隐藏服务器|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2851965|<security>
++++++<requestFiltering+removeServerHeader+="true"+/>
</security>|code-block|syntax|javascript|2851966|然而，VS会因为上面的无效而皱起眉头。上面的链接有图片代码，很难找到。MVC版本仍然是隐藏在应用程序启动如上，相同的x-powered-by和.Net版本。|2851967|entityMap|0|LINK|mutability|MUTABLE|url|https://blogs.msdn.microsoft.com/jpsanders/2015/10/07/remove-server-and-x-powered-by-headers-from-your-azure-mobile-apps/^0|P|C|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@$A|T|B|U|1|V]]|C|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|X|8|@]|9|@]|C|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]]]

MSDN published <a href="https://blogs.msdn.microsoft.com/jpsanders/2015/10/07/remove-server-and-x-powered-by-headers-from-your-azure-mobile-apps/" rel="nofollow noreferrer">this article</a> on how to hide headers on Azure Websites. You can now hide the server from web.config by adding an entry to system.webServer

<pre><code>&lt;security&gt;
 &lt;requestFiltering removeServerHeader ="true" /&gt;
&lt;/security&gt;
</code></pre>

VS will frown at the above as invalid though. The above link has code as pics, hard to find.
MVC version is still hidden in application start as above, same for x-powered-by and .Net version.

blocks|key|2851987|text|总结之前来自@givemy5分钟和@AKhooli的答案，因为它们与Azure网站相关，以及扫描器想要看到的一些其他项目，这些是我为了让ASafaWeb对Azure网站感到满意而做出的改变。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2851988|它仍然抱怨Azure亲和性头cookie不仅是https，而且亲和性是你想要重放的cookie类型，对吧？|2851989|<system.web>
++++<compilation+debug="false">
++++<httpRuntime+enableVersionHeader="false"+/>
++++<httpCookies+httpOnlyCookies="true"+requireSSL="true"+/>++++
++++<customErrors+mode="RemoteOnly"+defaultRedirect="~/Error.aspx"+/>
</system.web>

<system.webServer>
++++<httpProtocol>
++++++<customHeaders>
++++++++<add+name="X-Frame-Options"+value="DENY"+/>
++++++++<remove+name="X-Powered-By"+/>
++++++</customHeaders>
++++</httpProtocol>
++++<security>
++++++
++++++<requestFiltering+removeServerHeader="true"+/>
++++</security>
</system.webServer>|code-block|syntax|javascript|2851990|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Rolling up the previous answers from @giveme5minutes and @AKhooli as they relate to Azure Websites plus a few other items the scanner wants to see, these are the changes that I made to make ASafaWeb happy with an Azure site.

It still complains about the Azure affinity header cookie not being https only but affinity is the type of cookie you do want replayed anyway, right?

<pre><code>&lt;system.web&gt;
 &lt;compilation debug="false"&gt;
 &lt;httpRuntime enableVersionHeader="false" /&gt;
 &lt;httpCookies httpOnlyCookies="true" requireSSL="true" /&gt; 
 &lt;customErrors mode="RemoteOnly" defaultRedirect="~/Error.aspx" /&gt;
&lt;/system.web&gt;

&lt;system.webServer&gt;
 &lt;httpProtocol&gt;
 &lt;customHeaders&gt;
 &lt;add name="X-Frame-Options" value="DENY" /&gt;
 &lt;remove name="X-Powered-By" /&gt;
 &lt;/customHeaders&gt;
 &lt;/httpProtocol&gt;
 &lt;security&gt;
 &lt;!--removes Azure headers--&gt;
 &lt;requestFiltering removeServerHeader="true" /&gt;
 &lt;/security&gt;
&lt;/system.webServer&gt;
</code></pre>

blocks|key|3065464|text|尼克·埃文斯的答案很完美但是..。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3065465|如果出于安全的目的而删除这些头文件，不要忘了更改ASP.NET+Session+coockie+name！因为当您看到以下内容时，更容易猜测所使用的语言或服务器版本：|offset|length|style|BOLD|CODE|3065466|​|3065467|📷|atomic|3065468|3065469|更改cookie名称的：(要有创意)|3065470|<system.web>
++<sessionState+cookieName="PHPSESSID"+/>
</system.web>|code-block|syntax|javascript|3065471|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/391a59a8d4d7a6ba59f6ba5fcd809268.png|imageAlt^0|0|4|2|O|S|0|0|0|1|0|0|0|B|1|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|15|8|@$D|16|E|17|F|G]|$D|18|E|19|F|H]]|9|@]|A|$]]|$1|I|3|J|5|6|7|1A|8|@]|9|@]|A|$]]|$1|K|3|L|5|M|7|1B|8|@]|9|@$D|1C|E|1D|1|1E]]|A|$]]|$1|N|3|J|5|6|7|1F|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1G|8|@$D|1H|E|1I|F|G]]|9|@]|A|$]]|$1|Q|3|R|5|S|7|1J|8|@]|9|@]|A|$T|U]]|$1|V|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12|13|-4]]]]

<h2>Nick Evans' answer is perfect, but...</h2>

If you remove these headers for a security purpose, don't forget to change the <code>ASP.NET Session coockie name</code> !
Because it is easier to guess the language used or the server version when you see this :

<a href="https://i.stack.imgur.com/iOzLC.png" rel="noreferrer"><img src="https://i.stack.imgur.com/iOzLC.png" alt="enter image description here"></a>

To change the cookie name: (be creative)

<pre><code>&lt;system.web&gt;
 &lt;sessionState cookieName="PHPSESSID" /&gt;
&lt;/system.web&gt;
</code></pre>

I need to remove <a href="http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html" rel="noreferrer">excessive headers</a> (primarily to pass penetration testing). I have spent time looking at solutions that involve running UrlScan, but these are cumbersome as <a href="https://serverfault.com/a/364939/140297">UrlScan needs to be installed each time an Azure instance is started</a>.

There must be a good solution for Azure that does not involve deploying installers from startup.cmd.

I understand that the response headers are added in <a href="https://stackoverflow.com/questions/11155176/removing-headers-from-the-response">different places</a>:

<ul>
<li>Server: added by IIS.</li>
<li>X-AspNet-Version: added by System.Web.dll at the time of Flush in HttpResponse class</li>
<li>X-AspNetMvc-Version: Added by MvcHandler in System.Web.dll.</li>
<li>X-Powered-By: added by IIS</li>
</ul>

Is there any way to configure (via web.config etc.?) IIS7 to remove/hide/disable the HTTP response headers to avoid the "Excessive Headers" warning at <a href="https://asafaweb.com/" rel="noreferrer">asafaweb.com</a>, without creating an IIS module or deploying installers which need to be run each time an Azure instance starts?

Removing/Hiding/Disabling excessive HTTP response headers in Azure/IIS7 without UrlScan

服务器

我需要删除 (主要是为了通过渗透测试)。我花了很多时间研究涉及运行UrlScan的解决方案，但作为，这些解决方案都很麻烦。对于Azure来说，必须有一个好的解决方案，它不需要从startup.cmd部署安装程序。我知道响应头是在中添加的由IIS.X-AspNet-Version：添加的Server：在刷新时由Syste...

问在没有UrlScan的Azure/IIS7中删除/隐藏/禁用过多的HTTP响应头
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在没有UrlScan的Azure/IIS7中删除/隐藏/禁用过多的HTTP响应头EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在没有UrlScan的Azure/IIS7中删除/隐藏/禁用过多的HTTP响应头
EN