{"id":1005,"date":"2018-11-21T14:37:26","date_gmt":"2018-11-21T14:37:26","guid":{"rendered":"http:\/\/www.netexl.com\/blog\/?p=1005"},"modified":"2026-04-02T09:47:36","modified_gmt":"2026-04-02T09:47:36","slug":"configure-options-to-secure-asp-net-application","status":"publish","type":"post","link":"https:\/\/www.netexl.com\/blog\/configure-options-to-secure-asp-net-application\/","title":{"rendered":"Configuration Options to Secure ASP.NET Application"},"content":{"rendered":"

If you have ASP.NET website on internet,\u00a0you must make sure\u00a0to implement following cofiguration steps to secure your website.<\/p>\n

Block libwww-perl attack in ASP.NET Application hosted in IIS<\/strong> – Follow this article<\/a> to configure this.<\/p>\n

Some response headers\u00a0reveal technical details about the server which\u00a0must be\u00a0removed. For example a sample response from an ASP.Net application may look like this<\/p>\n

\"\"<\/p>\n

In this response “Server”, “X-AspNet-Version”, “X-Powered-By” headers are revealing technical details about the server. We can\u00a0remove these\u00a0unnecessary IIS response headers as following<\/p>\n

Remove “X-Powered-By” Header<\/strong> – Open web.config and\u00a0check for\u00a0customHeaders tag. If this is not already there, then add it as child of “<httpProtocol>” and add “remove” entry for X-Powered-By as shown below<\/p>\n

<configuration>\r\n  <system.webServer>\r\n    <httpProtocol>\r\n\t\t<customHeaders>\r\n\t\t\t<remove name=\"X-Powered-By\" \/>\r\n\t\t<\/customHeaders>\r\n    <\/httpProtocol>\t \r\n  <\/system.webServer>\r\n<\/configuration><\/pre>\n
You should also check the response from your\u00a0Asp.Net application if this is using a shared hosting which may add additional server specific information to response headers. Add remove entry for all such headers in your web.config.<\/p>\n
Remove “X-AspNet-Version” Header<\/strong> – In web.config file look for\u00a0<httpRuntime> under <system.web>.\u00a0 Add enableVersionHeader attribute and set its value to false.<\/p>\n
<httpRuntime targetFramework=\"4.5\" enableVersionHeader=\"false\" \/>\r\n<\/pre>\n
Remove “Server” Header<\/strong> –\u00a0Add following line in\u00a0Application_BeginRequest\u00a0 method of Global.asax.cs<\/p>\n
protected void Application_BeginRequest(object sender, EventArgs e)\r\n{\r\n    HttpContext.Current.Response.Headers.Remove(\"Server\");\r\n}<\/pre>\n
Add Security Headers in Response<\/strong> – Add additional security headers (X-Content-Type-Options<\/a>, X-Frame-Options<\/a>, X-XSS-Protection<\/a>) in response to harden security of the application. Add entries in web.config as following<\/p>\n
<customHeaders>\r\n\t<remove name=\"X-Powered-By\" \/>\r\n    <add name=\"X-Frame-Options\" value=\"DENY\" \/> \r\n    <add name=\"X-XSS-Protection\" value=\"1; mode=block\" \/> \r\n    <add name=\"X-Content-Type-Options\" value=\"nosniff \" \/>     \r\n<\/customHeaders>\r\n<\/pre>\n
If you are using iFrames in your website, you can set value of “X-Frame-Options” to “SAMEORIGIN”.<\/p>\n
After implementing these, check the response headers in browser developer console of your liking.\u00a0You can also use a third-party service such as\u00a0https:\/\/securityheaders.com<\/a> to quickly check\u00a0whether or not\u00a0 security headers are returned correctly from your website. The scan\u00a0may propose additional security headers for your website which you can implement if\u00a0need be.<\/p>\n","protected":false},"excerpt":{"rendered":"
If you have ASP.NET website on internet,\u00a0you must make sure\u00a0to implement following cofiguration steps to secure your website. Block libwww-perl attack in ASP.NET Application hosted in IIS – Follow this article to configure this. Some response headers\u00a0reveal technical details about the server which\u00a0must be\u00a0removed. For example a sample response from an ASP.Net application may look like this In this response “Server”, “X-AspNet-Version”, “X-Powered-By” headers are revealing technical details about the server. We can\u00a0remove these\u00a0unnecessary IIS response headers as following Remove “X-Powered-By” Header – Open web.config and\u00a0check for\u00a0customHeaders tag. If this is not already there, then add it as child of “<httpProtocol>” and add “remove” entry for X-Powered-By as shown below <configuration> <system.webServer> <httpProtocol> <customHeaders> <remove name=”X-Powered-By” \/> <\/customHeaders> <\/httpProtocol> <\/system.webServer> <\/configuration> You should also check the response from your\u00a0Asp.Net application if this is using a shared hosting which may add additional server specific information to response headers. Add remove entry[…]<\/p>\n","protected":false},"author":5,"featured_media":1547,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"class_list":["post-1005","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-asp-net"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/posts\/1005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/comments?post=1005"}],"version-history":[{"count":4,"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/posts\/1005\/revisions"}],"predecessor-version":[{"id":1016,"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/posts\/1005\/revisions\/1016"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/media\/1547"}],"wp:attachment":[{"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/media?parent=1005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/categories?post=1005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.netexl.com\/blog\/wp-json\/wp\/v2\/tags?post=1005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}