From the course: ASP.NET: Security

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Hiding server information

Hiding server information

From the course: ASP.NET: Security

Start my 1-month free trial

Hiding server information

“

- HTTP is a text based protocol and is such, very readable, or from an attackers point of view very revealing at times. Look at the screenshot I took from an APS.NET web application using the browser developer tools. These are parts of the HTTP headers the server sends in the HTTP response. Two of them provide maybe too much information, because the browser doesn't need this piece of information. First of all, which servers is being used in this server header and also which service set framework is used. Actually in older versions of ASP.NET MVC the MVC framework version was also part of that output. We would like to get rid of those, and maybe some other revealing HTTP headers, but we do not get this automatically by default, we have to configure it into the application and I'll show you how this is done. Once again we have to go into our web.config file and do some setting there, first of all system.webServer is responsible if you are using IIS their HTTP protocol custom headers…

Contents