Why aren't the Server and X-Powered-By headers being removed?

Question

My ASP.NET 4.5 app is being deployed to shared hosting so I do not have access to IIS settings. To remove the X-Powered-By header, I specify in web.config:

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

And to remove the Server header, I specify in Global.asax:

protected void Application_PreSendRequestHeaders(object sender, EventArgs e) {
  HttpContext.Current.Response.Headers.Remove("Server");
}

However, responses still contain both headers:

Cache-Control:private
Content-Encoding:deflate
Content-Length:672
Content-Type:text/html; charset=utf-8
Date:Sun, 06 Jan 2013 00:41:20 GMT
Server:Microsoft-IIS/7.5
X-Powered-By:ARR/2.5
X-Powered-By:ASP.NET

How can I remove them?

Answer 1

I'm not sure why your X-Powered-By isn't being removed, but a Windows Update patch earlier this year made it so that the Application_PreSendRequestHeaders fix no longer removed the Server: header for us.

We had to add a section to our system.webServer block (in the Web.config) using IIS URL Rewrite Module 2:

<rewrite>
    <outboundRules>
        <rule name="Remove RESPONSE_Server">
            <match serverVariable="RESPONSE_Server" pattern=".+"/>
            <action type="Rewrite" value=""/>
        </rule>
    </outboundRules>
</rewrite>

Answer 2

The X-Powered-By:ASP.NET is normally removed by simple web.config configuration:

<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
...

The ARR one is unaffected by this configuration, it has to be removed through the IIS Manager, Editor configuration on the IIS root (not on a site): go to system.webServer/proxy node and set arrResponseHeader to false. After an IISReset, it is taken into account.
I have found this one here, excepted this post is about old IIS 6.0 way of configuring things.

So for your case, without access to IIS settings, you would have to ask the server owner to adjust his configuration. Or try the Url Rewrite solution but of course, with HTTP_X_Powered_By server variable. It will at best only blank out the header, and I have not checked it works for the ARR case.