Server information disclosure

Question

we are getting a server information disclosed as the part of the API response. This API is hosted on the Windows VM of the azure cloud. Please suggest how we can remove the header with the server information.

Answer 1

Hi @Paras Nogia ,

Based on the screenshot, the server information being disclosed is:

Server: Microsoft-HTTPAPI/2.0

This header is returned by HTTP.sys, not by the application code itself. Since the response also shows 400 Bad Request - Invalid Hostname, the request may be getting rejected before it reaches the IIS site or the ASP.NET Core API.

For this specific header, one thing worth checking is the HTTP.sys registry setting on the Windows VM. Create or update the following DWORD value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
DisableServerHeader = 1

Microsoft documents this setting in Http.sys registry settings for Windows. A value of 1 stops HTTP.sys from appending the Server header for responses generated by HTTP.sys, such as 400 and 503 responses.

You can add it from an elevated Command Prompt or PowerShell window:

reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v DisableServerHeader /t REG_DWORD /d 1 /f

After making the change, restart the HTTP service and related IIS services, or reboot the VM during a maintenance window for the change to take effect.

You may also want to check why the request is returning 400 Bad Request - Invalid Hostname. This often happens when the request host name does not match the expected IIS site binding. You can check the HTTP.sys error log here:

C:\Windows\System32\LogFiles\HTTPERR\httperr.log

If the information I provided was helpful, I would greatly appreciate it if you could follow the instructions here so others with the same problem can benefit as well. 

Answer 2

In IIS on a Windows VM, the Server HTTP response header is added by the web server itself. To prevent server information disclosure, configure IIS to remove or overwrite this header at the web‑server level.

A common hardening approach is:

1. Configure IIS to stop sending the default Server header (for example, by using a URL Rewrite outbound rule or a custom module) so that the header is either removed or replaced with a generic value.
2. Ensure that no application code or reverse proxy in front of IIS re‑adds a more detailed Server header.
3. After configuration, test with a tool such as a browser dev tools network tab or curl to confirm that responses no longer expose Windows/IIS version details.

This aligns with general guidance on avoiding information disclosure: do not expose confidential or system‑specific data in protocol metadata such as headers.

---

References:

• Information Disclosure