Web applications and servers transmit various headers in their HTTP responses. These headers can provide metadata about the web content, offer control directives for caches, or even convey information about the server itself.
In the ASP.NET ecosystem, headers like X-Powered-By and server headers indicating Kestrel are quite commonplace. While they might seem innocuous at first glance, there are several compelling reasons to consider removing or obfuscating these headers. In this article, we'll delve into why that's the case.
Security through Obscurity
The principle of "security through obscurity" alone isn't a robust defense strategy. However, combined with other layers of security, it can be an effective measure to deter potential attackers.
-
Information Leakage: Headers like
X-Powered-Byreadily divulge that a site is running on ASP.NET. Likewise, theKestrelheader indicates the use of the Kestrel web server. This information provides attackers with a clear target, as they now know which platform's vulnerabilities to exploit. -
Reducing Attack Surface: By removing these headers, we're essentially hiding the technology stack from potential attackers. It forces them to invest more time and effort to figure out the underlying technologies, making opportunistic attacks less likely.
Professionalism and Branding
-
Custom Experience: A polished product or service doesn't reveal its underlying tools unless necessary. By stripping unnecessary headers, businesses can present a cleaner and more professional image to clients and competitors who might be scrutinizing their web services.
-
Branding Control: Organizations can replace standard headers with custom ones to align with branding or to send specific messages, ensuring they dictate the narrative around their tech stack and not the other way around.
Performance (Although Minimal)
While the performance gains might be negligible for most applications, it's still worth noting:
- Reduced Payload: Headers, albeit small in size, still consume bandwidth. By removing unnecessary headers, we can slightly reduce the response size, leading to faster transmissions, especially noticeable on large-scale applications.
Consistency Across Services
Organizations often use multiple technologies and platforms across their various services. By removing or standardizing headers:
-
Uniform Appearance: Organizations can ensure that responses from all their services appear consistent, regardless of the underlying technology.
-
Simplified Debugging: Standardizing responses can also make it easier to debug issues, as developers and operations teams won't get bogged down by tech-specific noise in the headers.
How to Remove These Headers in ASP.NET Core
In ASP.NET Core, it's possible to make modications in the Program.cs file to remove headers. On IIS 10 however, it's possible to just use the web.config. This saves the need to re-compile the application.
Example web.config changes:
