Enterprise Application Security Header

Question

Hello,

I am not too sure where to ask this question as I cannot find a forum for enterprise applications.

We have had a pen test done on one of our Azure Enterprise applications & have a question about security headers.
At an application level we have removed the server header from the website. This works fine internally, but when accessed via azure the Server header shows as
Microsoft-HTTPAPI/2.0

Is there a way to remove this, as part of the enterprise application.
or do I need an application gateway to be able to change this?

Thanks
Matt

Answer 1

Hello @MatthewRiddler-9775 , I assume your question is pertaining to your app deployed in Azure Web App. Please let me know if it's not the case. Assuming that is the case, please try one of the below depending on your configuration.

For Kestrel (In case your app is asp.net core and wired up for kestrel): Try setting Kestrel options like below snippet in Program.cs. The Kestrel Server header gets added too late in the request pipeline. Therefore removing it via the web.config or via middleware is not possible. Note: Below I used UseKestrel instead of ConfigureKestrel.

 public static IHostBuilder CreateHostBuilder(string[] args) =>
          Host.CreateDefaultBuilder(args)
              .ConfigureWebHostDefaults(webBuilder =>
              {
                  webBuilder.UseStartup<Startup>();
                  webBuilder.UseKestrel(options => options.AddServerHeader = false)
              });

For IIS integrated mode: You need to set in web.config like below:

 <configuration> 
    <system.webServer>
      <security>
        <requestFiltering removeServerHeader="true" />
      </security>
      <httpProtocol>
        <customHeaders>
          <remove name="X-Powered-By" />
        </customHeaders>
      </httpProtocol>
    </system.webServer>
  </configuration>

Answer 2

Hello,

@KrishnenduGhosh-MSFT

Not a web app that I am aware of.
It is an Enterprise application (under Azure Active Directory). Just presenting an internal applicattion through Azure.
The web server that is hosting this is not IIS, so the header cannot be coming from there.
I doubt it is coming from the ADFS server (where I believe the cipher suite comes from), as there is no IIS running on that server.

I have had a look at Web app & it definitely is not one of those.
Thanks,
Matt