Can't Remove Server Name in Request Header in HTTP- Azure App Service

user_7735202 0
Viewed 1216

I've did the necessary web.config (found in D:\home\site\wwwroot), this also have a rewrite rule to redirect all to https

        <configuration>
        <system.web>
           <!-- <compilation debug="true" targetFramework="4.5.1" />
            <httpRuntime targetFramework="4.5.1" enableVersionHeader="false" />-->
            <httpRuntime enableVersionHeader="false" />
            <!--<customErrors mode="RemoteOnly" defaultRedirect="https://concierge.digitaldesk.accenture.com"/>-->
        </system.web>
        <system.webServer>
            <security>
<requestFiltering removeServerHeader="true"/>
</security>

Based on https://securityheaders.com/

Raw Headers With Redirect

enter image description here

Raw Header Without the redirect

enter image description here

It suddenly shows the server name, i need to remove it also.

Please help!!

iis-10 azure-web-app-service azure web-config asp.net
2 Answers

I think your problem is related to the settings "HTTPS only" from the web app TLS/SSL settings section in Azure Portal. If you have "HTTPS only" set to ON, the first request to HTTP ( not HTTPS ) doesn't hit your application code and your web.config doesn't apply. Microsoft is directly responding with 301 ( + Server Header ). The next request doesn't have the server name because the web.config rules are applying.

Try to disable "HTTPS only" and do the redirect with a rule in web.config or in application code. This should fix the problem.

To prove my analysis, with the "HTTPS only" set to ON, search in logs for requests to http: If you have application insights set up you can query the logs like this

requests 
| where url startswith "http:" 
| order by timestamp desc

If my analysis is correct you will not find any request there. But if you disable "HTTPS only" then you will also see the request to http

user_37287230

I can't reproduce this issue on my side. Both redirect and non-redirect request will be removed on my side. Did you missed to set disableServerHeader for original URL? And have you tried to clean browser cache because 301 redirection can be cached.

I think you could use outbound rule instead because IIS outbound rule will remove the value of response_server header all the time.

enter image description here

<outboundRules>
    <rule name="Remove response">
        <match serverVariable="RESPONSE_SERVER" pattern="(.*)" />
        <action type="Rewrite" />
    </rule>
</outboundRules>
user_119446120
Related