Change ASP.NET Version of Azure app service

user_6179613 0
Viewed 1321

Our application has a header that specifies X-AspNet-Version → 4.0.30319. This is bad not only because we're displaying which version we're using, which those with malicious intent could use against us, but also because the version itself has many vulnerabilities. My question is not how to hide the header, I've already figured that out, but rather I'd like to actually upgrade the version. I am using an Azure app service and in my web.config file I have tried the code below to no avail.

<httpRuntime targetFramework="4.7.1" />

The header still shows the same (X-AspNet-Version → 4.0.30319). How am I suppose to update this? Is it something that I can't control? I am not even using ASP.NET in my application.

azure-web-app-service azure http-headers asp.net
1 Answers

How am I suppose to update this? Is it something that I can't control?

Short answer is that we can't do it. X-AspNet-Version → 4.0.30319 is not the actual .NET framework version. It is the version of the CLR. .Net 4, 4.5 and later releases the CLR version include CLR 4.

For more information, please refer to .NET Framework versions and dependencies

The CLR is identified by its own version number. The .NET Framework version number is incremented at each release, although the CLR version is not always incremented. For example, the .NET Framework 4, 4.5, and later releases include CLR 4, but the .NET Framework 2.0, 3.0, and 3.5 include CLR 2.0. (There was no version 3 of the CLR.)

This is bad not only because we're displaying which version we're using, which those with malicious intent could use against us, but also because the version itself has many vulnerabilities.

For security reason, as you mentioned that you could hide the header.

user_70051590
Related