Remove server header in self hosted WebApi response

Question

We are using a self hosted WebApi and we are required to remove the server header (Server: Microsoft-HTTPAPI/2.0) of the responses sent.

Since it is self hosted, a HttpModule is not an option. Implementing a DelegatingHandler, access to headers as well as adding is possible. The asp.net website nicely details how one can do that.

But the server header seems to be added much later in the pipeline since it is not set in the HttpResponseMessage we return from the DelegatingHandler. However, we are able to add values.

async protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
    HttpResponseMessage response = await base.SendAsync(request, cancellationToken);
    response.Headers.Server.Add(new ProductInfoHeaderValue("TestProduct", "1.0"));
    response.Headers.Add("Server", "TestServerHeader");

    return response;
}

Both Server.Add and .Add work as expected. response.Headers.Remove("Server"); however does not work, because the server header is not set, response.Headers.Server is empty.

Is there anything i am missing?

Answer 1

There is no code solution to remove Server HTTP header on self host. The only solution is to edit windows registry: https://docs.microsoft.com/ru-ru/archive/blogs/dsnotes/wswcf-remove-server-header

Answer 2

add

appBuilder.Use((context, next) =>
        {
            context.Response.Headers.Remove("Server");
            context.Response.Headers.Add("Server", new[] { "" });
            return next.Invoke();
        });

to Startup Configuration method just before

config.EnsureInitialized();