Add security headers to help protection from injection attacks in c# asp.net

Question

I have a C# asp.net application.It was sent to security assessment and below were the risks.

-Missing "Content-Security-Policy" header
-Missing "X-Content-Type-Options" header
-Missing "X-XSS-Protection" header 
-It was observed that server banner is getting disclosed in HTTP response.
-It was observed that service version is getting disclosed in HTTP response.

I have the below code in the web.cofig file

I thought this will add the headers. But the security team says the issue is not fixed. Is there any alternate for this.And for the Banner disclosure, I don't have access to server. can I fix this within the application. After research I found this: Inside Global.asax I have this code:

protected void Application_PreSendRequestHeaders()
    {
        // Response.Headers.Remove("Server");
        Response.Headers.Set("Server", "My httpd server");
        Response.Headers.Remove("X-AspNet-Version");
        Response.Headers.Remove("X-AspNetMvc-Version");
    }

    protected void Application_BeginRequest(object sender, EventArgs e)
    {
        var app = sender as HttpApplication;
        if (app != null && app.Context != null)
        {
            app.Context.Response.Headers.Remove("Server");
        }
    }

Is this the correct fix. Please help

user_10357557 · Answer

Ensure you add the httpProtocol in the system.webServer as shown below:

To remove the "server" header, add the code below in your Global.asax file

protected void Application_PreSendRequestHeaders()
{
    Response.Headers.Remove("Server");
}

user_1129978 · Answer

You can add any header globally using web.config e.g.

Refer : Adding Custom Headers Globally

Add security headers to help protection from injection attacks in c# asp.net

3 Answers