Bad Gateway exposing server header

Question

Using Azure Functions

I was getting 502 Bad Gateway but it is revealing my server information in response headers. In code I have added customheaders setting already. But the thing is, I don't think it is reaching my code during 502 error. Can there be any settings done on configuration level as we are **not using APIM on this particular function app.

host.json

-------------------------------------------------------------------------

"extensions": {
"http":
{
"customHeaders": {
"Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
"Content-Security-Policy": "default-src 'self'",
"Server": "None",
"Strict-Transport-Security": "max-age=31536000; includeSubDomains",
"X-Content-Type-Options": "nosniff",
"X-Frame-Options": "DENY"
}
}
}

------------------------------------------------------------------------------

Below is the screenshot.

Answer 1

Hi @Anonymous ,

For a 502 response, the request will not have reached the back end worker process, so implementing changes in the web.config and global.asax would not work as it won't reach the backend server. The resulting server header is not the server header of the application’s web server, but of a proxy in between. This proxy is a Front end load balancer that forwards the requests to the backend server.

Unfortunately, it is not possible to remove the Server header from the response generated solely by the Azure Function Front End (FE) instances/server. You can have a Azure APIM in front of the Azure functions to mask the server details.

Hope this helps! Feel free to reach out to me if you have any questions or concerns.