隱藏ASP.NET站點的HTTP Headers

站點的Headers裏面會暴露一些服務器的環境，例如IIS版本、語言的環境等

有時候咱們不想讓用戶瞭解這類信息那麼能夠這樣作：

一、修改web.config

在 <system.webServer> 節點裏加上隱藏掉 X-Powered-By

  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
      <remove name="Server" />
    </customHeaders>
  </httpProtocol>

二、增長一個 HttpHeadersCleanup 類

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;

namespace MyNameSpace
{
    /// <summary>
    /// Removing HTTP Headers for ASP.NET sites
    /// </summary>
    public class HttpHeadersCleanup : IHttpModule
    {
        public void Init(HttpApplication context)
        {
            context.PreSendRequestHeaders += PreSendRequestHeaders;
        }

        private static void PreSendRequestHeaders(object sender, EventArgs e)
        {
            try
            {
                HttpApplication app = sender as HttpApplication;
                var headers = app.Context.Response.Headers;
                if (null != headers)
                {
                    headers.Remove("Server");
                }
            }
            catch { }
        }

        public void Dispose()
        {
        }
    }
}

三、再次修改web.config

在 <system.webServer> 節點下增長：

  <!--Removing HTTP Headers for ASP.NET sites-->
  <modules runAllManagedModulesForAllRequests="true">
    <add name="HttpHeadersCleanup " type="MyNameSpace.HttpHeadersCleanup"/>
  </modules>

 

修改完成的 <system.webServer> 節點：

<system.webServer>
  <!--Removing HTTP Headers for ASP.NET sites-->
  <modules runAllManagedModulesForAllRequests="true">
    <add name="HttpHeadersCleanup " type="MyNameSpace.HttpHeadersCleanup"/>
  </modules>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
   ......
</system.webServer>

 

發佈後再看HTTP Headers簡潔多了：