App gateway v2 - unable to remove Server response header with response code 501

Question

I'm having vulnerability when getting response with http code 501. I'm getting the server field in the headers:
"Server" key, value "Microsoft-Azure-Application-Gateway/v2"
And also

I'm using Azure Application Gateway v2 to use rewrite rules to solve this. With the rewrite, I can delete the server key in the response headers when getting 2xx http codes but for responses with 4xx and 5xx I'm still getting the server key in the headers. How can I resolve this?

Thanks in advance.

Answer 1

Hello @Stanislav Harvan ,

I checked with the Azure Application Gateway Product Group team and below is their response on this issue:

Rewrites do not work on responses generated directly from the Application Gateway.
This is currently not supported and is part of the backlog. There isn’t an ETA on this but we will be working on this limitation soon.

I am working with the team to add this to the limitation section on our docs:
https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url#limitations

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Vote here to get this issue higher priority - https://feedback.azure.com/d365community/idea/88a5fb41-8010-ee11-a81c-000d3adb7ffd