locked
How to remove X-Powered-By ARR/2.5 header banner in IIS RRS feed

  • Question

  • User235715802 posted

    Dear All,

    I want to remove following banner from my response, how and where to do the same.

    X-Powered-By: ARR/2.5

    Thanks in advance.

    Tuesday, April 17, 2012 4:50 AM

Answers

  • User-176674611 posted

    Hi fab777,

    As I know, arr response headers cannot be remove via custom headers settings. To remove X-Powered-By response header, you will need to set arrResponseHeader to false in server proxy settings:

    %windir%\system32\inetsrv\appcmd set config  -section:system.webServer/proxy /arrResponseHeader:"False"  /commit:apphost

    Thanks.

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Monday, April 23, 2012 1:57 AM

All replies

  • User-1499466209 posted

    Hi,

    If you want to do it via IIS Manager GUI:

    1. Launch the Internet Information Services (IIS) Manager
    2. Expand the Sites folder
    3. Select the website to modify and double-click the HTTP Response Headers section in the IIS grouping.
    4. Each custom header is listed here, as the screen shot below shows. Select the header to remove and click the Remove link in the right-hand column.

    If you want to do it via your application, add this in your web.config file:

    <system.webServer>
       
    <httpProtocol>
           
    <customHeaders>
               
    <remove name="X-Powered-By: ARR/ 2.5" />
           
    </customHeaders>
       
    </httpProtocol>
    </system.webServer>
    Tuesday, April 17, 2012 5:15 AM
  • User-176674611 posted

    Hi fab777,

    As I know, arr response headers cannot be remove via custom headers settings. To remove X-Powered-By response header, you will need to set arrResponseHeader to false in server proxy settings:

    %windir%\system32\inetsrv\appcmd set config  -section:system.webServer/proxy /arrResponseHeader:"False"  /commit:apphost

    Thanks.

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Monday, April 23, 2012 1:57 AM
  • User-1499466209 posted

    Hi fab777,

    As I know, arr response headers cannot be remove via custom headers settings

    So, you're probably right : I never worked with ARR. I just assumed that's it will be the same way to disable the header as to disable ant custom header.

    Do you think the "applicative way" (modifying the web.config file) works?

     

    Monday, April 23, 2012 4:33 AM
  • User-176674611 posted

    I just did a test, and as expected, modifying the web.config does not work. Here's my understanding on this issue:

    In web.config, we can only remove settings that is already set at a higher level(applicationHost.config). However, the response header X-Powered-By: ARR/2.5 is appended by arr module. When IIS read the custom header section, it do not know such header will be appended for response. Hence, removing does not work for this case.

    I hope this make it clear. If I'm wrong, please do let me know.

    Thanks. 

    Monday, April 23, 2012 4:55 AM
  • User-1499466209 posted

     Ok, thanks for doing the test for me and for the answer. I will need to work with ARR and add it to my skills...

    Monday, April 23, 2012 5:05 AM
  • User-176674611 posted

    With pleasure :)

    Monday, April 23, 2012 5:08 AM
  • User235715802 posted

    By this command it turn off the arr response header for all sites or one can do that for specific site

    Also why the /proxy is used after system.webServer?

    Wednesday, May 9, 2012 12:28 AM
  • User990644438 posted
    Hope the below link helps you, https://forums.iis.net/p/1189254/2020980.aspx
    Monday, May 21, 2012 2:23 AM