[英]how to remove server info via <customHeaders> in web.config
I have removed the x-powered-by using <httpProtocol>
我已经使用
<httpProtocol>
删除了x-powered-by
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
<remove name="Server" />
</customHeaders>
</httpProtocol>
This hides the X-Powered-By
but the server (IIS info ) is still not getting removed 这将隐藏
X-Powered-By
但是服务器(IIS信息)仍未被删除
It would be good if there is a way where I can remove all the info in the Response Header
如果有一种方法可以删除
Response Header
中的所有信息,那将是很好的
How can i do it? 我该怎么做?
I believe you need UrlScan to remove the IIS info. 我相信您需要UrlScan才能删除IIS信息。
The particular setting you need to configure is: RemoveServerHeader 您需要配置的特定设置是: RemoveServerHeader
By default, a Web server returns a header that identifies what Web server software it is running in all responses.
默认情况下,Web服务器返回一个标头,该标头标识其在所有响应中运行的Web服务器软件。 This can increase the server vulnerability because an attacker can determine that a server is running IIS and then attack known IIS problems, instead of trying to attack an IIS server by using exploits that are designed for other Web servers.
这可能会增加服务器漏洞,因为攻击者可以确定服务器正在运行IIS,然后攻击已知的IIS问题,而不是尝试通过使用为其他Web服务器设计的漏洞来攻击IIS服务器。 By default, this option is set to 0. If you set the RemoveServerHeader option to 1, you prevent your server from sending the header that identifies it as an IIS server.
默认情况下,此选项设置为0。如果将RemoveServerHeader选项设置为1,则可以防止服务器发送将其标识为IIS服务器的标头。 If you set RemoveServerHeader to 0, this header is still sent.
如果将RemoveServerHeader设置为0,则仍发送此标头。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.