U4-7503 - X-AspNet-Mvc-Version header is returned

Yes, please! Does it also remove Server: IIS? :)

Weirdly enough, it should be sufficient to add: <system.web> </system.web> (http://stackoverflow.com/a/3418574/5018)

This is what we ship with, but that's apparently not enough sometimes.

Would be great if all these were removed: HttpContext.Current.Response.Headers.Remove("X-Powered-By"); HttpContext.Current.Response.Headers.Remove("X-AspNet-Version"); HttpContext.Current.Response.Headers.Remove("X-AspNetMvc-Version"); HttpContext.Current.Response.Headers.Remove("Server");

Server is removed at IIS level I believe, and it looks like X-Powered-By and X-AspNet-Version are already removed. PR will be with you this afternoon :)

I would still want to remove all of these on the application level so that the server can't override these setting in their hosting config. Some hosting providers are just REALLY proud that they're running IIS.. :)

This post seems to cover all of them, just don't set the server name to something random, remove it instead: http://r2d2.cc/2011/10/21/how-to-remove-server-x-aspnet-version-x-aspnetmvc-version-and-x-powered-by-from-the-response-header-in-iis7/

For the server header: there's probably somewhere in Umbraco.Web.UmbracoModule where you can add this. And for the others I'd have a look in Umbraco.Web.UmbracoApplication(Base?).

I've added the line for removing the MVC version header to the WebBootManager class, but on second thoughts the StartApplication method in the UmbracoApplicationBase class may be a better place for it.

Haven't had a chance to look at the other headers yet, I'll have a look at those this evening.

edit: Just had a look at the InitMehtod in UmbracoModule and httpContext.Response.Headers.Remove("Server"); is already in there.

Cool, I see now, and the code comment is true:

//this doesn't normally work since IIS sets it but we'll keep it here anyways. It indeed does not work (for one of my sites) ;-)

PR submitted: https://github.com/umbraco/Umbraco-CMS/pull/942

I settled on disabling it in the WebBootManager, but if you think it would be better in UmbracoApplicationBase let me know and I'll refactor.

I've also removed the X-AspNet-Version and X-AspNetMvc-Version headers from the response headers collection which seems to work.

Thanks James! All merged in!