Configuration Options to Secure ASP.NET Application
If you have ASP.NET website on internet, you must make sure to implement following cofiguration steps to secure your website. Block libwww-perl attack in ASP.NET Application hosted in IIS – Follow this article to configure this. Some response headers reveal technical details about the server which must be removed. For example a sample response from an ASP.Net application may look like this In this response “Server”, “X-AspNet-Version”, “X-Powered-By” headers are revealing technical details about the server. We can remove these unnecessary IIS response headers as following Remove “X-Powered-By” Header – Open web.config and check for customHeaders tag. If this is not already there, then add it as child of “<httpProtocol>” and add “remove” entry for X-Powered-By as shown below <configuration> <system.webServer> <httpProtocol> <customHeaders> <remove name=”X-Powered-By” /> </customHeaders> </httpProtocol> </system.webServer> </configuration> You should also check the response from your Asp.Net application if this is using a shared hosting which may add additional server specific information to response headers. Add remove entry[…]