funnelweblog/FunnelWeb — pull request #21 by JSkimming (2012-11-04 12:50:02+00:00)
Title: Reduced Version Headers in HTTP responses

By default ASP.NET and MVC include version information in the HTTP header of every response. Divulging the software version information is a minor security hole, but it is also adding needless payload to every response.

I have deployed the changes to my site hosted in an Azure website. Here are the HTTP headers in the response for the home page showing before and after the change. This was captured using [fiddler](http://www.fiddler2.com/fiddler2/).

### Before
```
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 4074
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
Set-Cookie: ARRAffinity=obscured to protect the innocent
X-AspNetMvc-Version: 4.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/2.5
X-Powered-By: ASP.NET
Date: Sun, 04 Nov 2012 12:17:39 GMT
```

### After
```
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 4074
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
Set-Cookie: ARRAffinity=obscured to protect the innocent
X-Powered-By: ARR/2.5
X-Powered-By: ASP.NET
Date: Sun, 04 Nov 2012 12:34:47 GMT
```

As shown `X-AspNetMvc-Version`, `X-AspNet-Version` and one of the `X-Powered-By: ASP.NET` headers have been removed. The remainder are from the hosting infrastructure and I can't find a way to remove them when hosted in an Azure website.