How to rewrite HTTP response Server header from Reporting ServicesRSS

6 replies

Last post Oct 11, 2019 01:20 AM by Jalpa Panchal

  • How to rewrite HTTP response Server header from Reporting Services

    Oct 09, 2019 09:11 AM|nkphuc700|LINK

    I am using SSRS 2016 for my report. And every time I access a report, the response always contains the IIS server information. I want to hide or rewrite this sensitive information from the HTTP response Server header (please see the attached image)

    SSRS response

    Besides, Reporting Services uses Http.sys directly from the server’s operating system to accept requests directed to URLs and ports configured for Reporting Services. This architectural change allows Reporting Services to exist without IIS and provides the same functionality. So, the solution to use URLRewrite extension and create an outbound rule in IIS does not help in this case.

    Is there any way we can configure to hide/rewrite the HTTP response Server header in Reporting Services? Can we do it in Reporting Services Configuration Manager?

  • Re: How to rewrite HTTP response Server header from Reporting Services

    Oct 10, 2019 05:45 AM|Jalpa Panchal|LINK

    Hi,

    You could try to use the registry key setting:

    Create a DWORD entry called DisableServerHeader in the following Registry key and set the value to 1.
    HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

    After adding the Registry key, restart the HTTP service using the net stop HTTP command and the net start HTTP command. If the HTTP service doesn’t start up then use the iisreset command. If that also doesn’t work then you can restart the server.

    You could also use urlscan tool:

    Install the URLScan in your machine by the below link.

    https://docs.microsoft.com/en-us/iis/extensions/working-with-urlscan/urlscan-3-reference

    After installing URLScan, open the URLScan.ini file typically located in the %WINDIR%\System32\Inetsrv\URLscan folder. After opening it, search for the key RemoveServerHeader. By default, it is set to 0, but to remove the Server header, change the value to 1.Doing so will remove the Server header Server: Microsoft-IIS/7.5 from the User mode response.

    changes made by URLScan at the global level apply to all of your sites. If you would like to set up this for a particular site then look at the following article (site filter section).

    https://docs.microsoft.com/en-us/iis/extensions/working-with-urlscan/urlscan-setup

    You could also use the below code in the web.config file:

    <security>
      <requestFiltering removeServerHeader ="true" />
    </security>

    Regards,

    Jalpa

    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue.
    If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.
  • Re: How to rewrite HTTP response Server header from Reporting Services

    Oct 10, 2019 07:11 AM|nkphuc700|LINK

    Thank Jalpa for your time to post a long instruction.

    Unfortunately, the suggestion does not work for responses returned from Reporting Services which is not handled by the IIS server. It just works for responses returned from IIS. I already verified it and here is my information.

  • Re: How to rewrite HTTP response Server header from Reporting Services

    Oct 10, 2019 07:19 AM|Jalpa Panchal|LINK

    did you restart your machine after doing a registry setting? 

    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue.
    If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.
  • Re: How to rewrite HTTP response Server header from Reporting Services

    Oct 10, 2019 07:41 AM|Jalpa Panchal|LINK

    your issue is most likely to the asp.net related you could post it on asp.net forum. 

    https://forums.asp.net/

    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue.
    If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.
  • Re: How to rewrite HTTP response Server header from Reporting Services

    Oct 10, 2019 09:55 AM|nkphuc700|LINK

    Yes, I did

  • Re: How to rewrite HTTP response Server header from Reporting Services

    Oct 11, 2019 01:20 AM|Jalpa Panchal|LINK

    As I said your issue is most likely to the asp.net related you could post it on asp.net forum.

    https://forums.asp.net/

    thank you for understanding.

    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue.
    If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.