Removing 'Server' Header not working in ASP.NET Core 8 does not work with middleware or IIS Manager

Question

I am trying to remove the Server Header from the HTTP response in my application.

I’ve seen quite a bit of information online and tried several things, but none have worked.

I’ve tried using the ASP.NET Core middleware directly in the pipeline, following examples like this video

app.Use(async (context, next) =>
{
    context.Response.OnStarting(state =>
    {
        var httpContext = (HttpContext)state;
        httpContext.Response.Headers.Remove("Server");
        return Task.CompletedTask;
    }, context);

    await next.Invoke(context);
});

I’ve also seen this post and I’ve explicitly checked to ensure that the "Server" header is included in the response:

app.Use(async (context, next) =>
{
    context.Response.OnStarting(state =>
    {
        var httpContext = (HttpContext)state;
        if (context.Response?.Headers?.ContainsKey("Server") ?? false)
        {
            httpContext.Response.Headers.Remove("Server");
        }
        return Task.CompletedTask;
    }, context);

    await next.Invoke(context);
});

I’ve also tried using the URL Rewrite module as shown in this video but it didn’t work for me.

Lastly, I’ve also created a custom middleware with every method I could find to remove this header.

namespace POCWebAppRewriteUrl
{
    public class ResponseHeadersMiddleware
    {
        private readonly RequestDelegate _next;

        public ResponseHeadersMiddleware(RequestDelegate next)
        {
            _next = next;
        }

        public async Task Invoke(HttpContext context)
        {
            context.Response.Headers.Remove("Server");

            context.Response.OnStarting(() =>
            {
                context.Response.Headers.Remove("Server");
                return Task.CompletedTask;
            });

            context.Response.OnCompleted(() =>
            {
                if (context.Response.Headers.ContainsKey("Server"))
                {
                    context.Response.Headers.Remove("Server");
                }
                return Task.CompletedTask;
            });

            await _next(context);
        }
    }
}

As you can see here in Postman, I’m still seeing the "Server" header in the response.

Note that I don't want to include a web.config file to solve this problem. I already did this in the net framework 4.7 version of the project but now I'm migrating to net core 8: I had this:

<rewrite>
  <outboundRules>
   <rule name="Remove Server">
     <match serverVariable="RESPONSE_SERVER" pattern=".*"/>
     <action type="Rewrite" value="None"/>
   </rule>
  </outboundRules>
</rewrite>

Any ideas why I’m not able to remove the header? Thanks a lot.

Answer 1

I see you’re talking about the header added by IIS. I don’t think you can remove that in your C# project, but you can disable it in IIS’s site config here:

(Set removeServerHeader to True under system.webServer/Security/requestFiltering)

Hitting “Apply” immediately worked for me, no restarting necessary.

Removing the “Server: Kestrel” header

Kestrel can be prevented from adding its own server header in program.cs:

builder.WebHost.UseKestrel(opts => opts.AddServerHeader = false);

Or for a configurable approach, do this instead:

builder.Services.Configure<KestrelServerOptions>(builder.Configuration.GetSection("Kestrel"));

Then it’ll honour the Kestrel configuration, for example from appsettings.json:

"Kestrel": {
    "AddServerHeader": false,
},

Or from start parameters:

--Kestrel:AddServerHeader=false