Configuring Secure IIS Response Headers in ASP.NET MVC

In this post, Will do this in an ASP.NET MVC web application. Instead of configuring these settings in the IIS server, this time I’m going to do this in the ASP.NET code itself since it gives more flexibility and does not affect other applications hosted on the same IIS server.

Following is the default IIS response, which includes detailed technical information on the server, and the asp.net version and MVC version.

We need to hide the following headers.

Server

X-AspNet-Version

X-AspNetMvc-Version

X-Powered-By

Removing Server Header

Open the Global.asax.cs file. Use Application_BeginRequest event to hide the server header. Add the following event to the file, if that method already exists, add the content of following method into the existing event method.

protected void Application_BeginRequest(object sender, EventArgs e) {

var app = sender as HttpApplication;

if (app != null && app.Context != null) {

app.Context.Response.Headers.Remove("Server");

}

Removing X-AspNet-Version Header

Open the Web.Config file, find the node <httpRuntime> under <system.web> add the enableVersionHeader attribute to httpRuntime node and set it to false.

Removing X-AspNetMvc-Version Header

Open the Global.asax.cs file, find the event Application_Start event and add the following line at the end of the code.

protected void Application_Start()

{

//some code

MvcHandler.DisableMvcResponseHeader = true; //this line is to hide mvc header

}

Removing X-Powered-By Header

Open the Web.Config file, find the <httpProtocol> node under the <system.webServer> node. Check whether these is a child node under <httpProtocol> called <customHeaders>. By default in MVC, you will not see this customHeaders child node. If it does not exist, create a <cusstomHeaders> node and add following include following to remove X-Powered-By header.

</customHeaders>

</httpProtocol>

After removing above headers, the IIS response will look like this.

Note:

X-SourceFiles Header included the base64 encoded physical path of the source files in your hard disk. This header is only sent for the request from localhost. So, there’s no need to worry about removing this.

Add Secure Response Headers

Now we have removed the headers that disclose internal technical details of the web server. We can now add additional security headers that harden the security of the application. Those additional security headers are as follows. You can learn more about what those headers do, here.

X-Frame-Options

X-XSS-Protection

X-Content-Type-Options

There are few ways to configure secure response headers in an asp.net application. One is to add a <customHeaders> node inside <httpProtocol> in Web.Config. The other way is to use NWebsec package which can be used to configure secure response headers.

Using <customHeaders> in Web.Config

To add these headers, go to the <customHeaders> node previously added and add those headers inside the <customHeaders> node.

</add></add></add></remove></customheaders>

</httpprotocol>

Using NWebsec

For this, you need to install NWebsec package in Visual Studio using Package Manager Console.

Go to Tools -> Library Package Manager -> Package Manager Console

Install NWebSec Package using Package Manager Console.

PM > Install-Package NWebsec

After installation, find the node <nwebsec> inside Web.Config. Insert following entries inside its child node <httpHeaderSecurityModule>.

<x-Xss-Protection blockmode="true" policy="FilterEnabled"></x-Xss-Protection> <x-Content-Type-Options enabled="true"></x-Content-Type-Options>

<x-Frame-Options policy="Deny"> </x-Frame-Options>