为什么不能通过web删除“服务器”响应头?在IIS7配置吗?

Remove Server Response Header IIS7

删除服务器响应头IIS7

I know how to remove the Server response header with an HTTP Module based on the link above.

我知道如何使用基于上述链接的HTTP模块删除服务器响应头。

I just want to know why it is necessary to remove it this way.

我只是想知道为什么要用这种方法去除它。

5 个解决方案

#1

The comments in Aristos link gives as good an answer to the Why.

马兜铃的评论给出了一个很好的答案。

It boils down to MS not wanting to easily let people modify this value. Whether for marketing or other purposes is open to interpretation.

归根结底，MS不希望让人们轻易地修改这个值。无论是出于市场营销还是其他目的，都有待解释。

One thing to take away from that discussion is that modifying the server header is not useful for any sort of security. There are a myriad of ways that you can detect exactly what kind (and version) of web server software is running.

从这一讨论中要注意的一点是，修改服务器头对任何类型的安全性都没有用处。有无数种方法可以精确地检测web服务器软件的类型(和版本)。

Which leaves us with only one reason to do so: to save bytes. Unless you're running an extremely high traffic site this isn't a concern. If you are running a high traffic site then you are more than likely already running one or more custom modules.

只有一个原因让我们这么做:保存字节。除非你运行的是一个高流量的网站，否则这不是问题。如果您正在运行一个高通信量的站点，那么您很可能已经运行了一个或多个自定义模块。

#2

This example is not really remove the "server" header, just write something else on it.

这个例子并没有真正删除“服务器”标题，只是在上面写点别的东西。

A better title is "IIS7 how to send a custom "Server" http header". Read this similar article http://blogs.technet.com/b/stefan_gossner/archive/2008/03/12/iis-7-how-to-send-a-custom-server-http-header.aspx

更好的标题是“IIS7如何发送自定义的”服务器“http头”。阅读类似的文章http://blogs.technet.com/b/stefan_gossner/archive/2008/03/12/iis-7-how-to-send- custom-server-http-header.aspx

Now if you wondering why this way, this is not the only one way, you can go to your web server and just remove it from the initials headers.

如果您想知道为什么是这种方式，这并不是唯一的一种方式，那么您可以到web服务器并将其从首字母标头中删除。

If you wondering, why to use the IHttpModule + PreSendRequestHeader, because this is the way you grab the headers on the initial part and place first the "server" header before iis do that.

如果您想知道，为什么要使用IHttpModule + PreSendRequestHeader，因为这是在iis执行之前获取初始部分头部并首先放置“server”头部的方式。

Hope this help.

希望这个有帮助。

#3

Basic idea of removing those header are as follows

删除这些标题的基本思想如下

For security reason. it won't be easy to determine by the attacker about the software(version) and web server is backing the site.
出于安全的原因。由攻击者决定软件(版本)和web服务器支持站点是不容易的。
It reduce the size of the data produce by the server end to browser.
它减少了服务器端到浏览器生成的数据的大小。

阅读有关检查Http响应头的更多信息

#4

You can also empty the value by adding an outboundRule in the web.config file in IIS 7+:

您还可以通过在web中添加outboundRule来清空值。IIS 7+中的配置文件:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <outboundRules rewriteBeforeCache="true">
                <rule name="Remove Server header">
                    <match serverVariable="RESPONSE_Server" pattern=".+" />
                    <action type="Rewrite" value="" />
                </rule>
            </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>

#5

-1

Response.Headers.Set("Server", "My Awesome Server"); works fine in the Page code-behind, so long as your application pool is set to "Integrated Pipeline Mode."

Response.Headers。集(“服务器”、“我棒服务器”);只要将应用程序池设置为“集成管道模式”，就可以在页面代码背后正常工作。

Basically, IPM is specifically for the purpose of having the IIS pipeline be integrated with the ASP.NET pipeline to allow this kind of thing to be done. See Mehrdad Afshari's Answer for discussion.

基本上，IPM的目的是让IIS管道与ASP集成。网络管道允许这样的事情发生。参见Mehrdad Afshari的答案进行讨论。

#1