IIS 7 and Above
URL Rewrite Module
How to rewrite HTTP response Server header from Reporting Services
Last post Oct 11, 2019 01:20 AM by Jalpa Panchal
Oct 09, 2019 09:11 AM|nkphuc700|LINK
I am using SSRS 2016 for my report. And every time I access a report, the response always contains the IIS server information. I want to hide or rewrite this sensitive information from the HTTP response Server header (please see the attached image)
Besides, Reporting Services uses Http.sys directly from the server’s operating system to accept requests directed to URLs and ports configured for Reporting Services. This architectural change allows Reporting Services to exist without IIS and provides the
same functionality. So, the solution to use URLRewrite extension and create an outbound rule in IIS does not help in this case.
Is there any way we can configure to hide/rewrite the HTTP response Server header in Reporting Services? Can we do it in Reporting Services Configuration Manager?
Oct 10, 2019 05:45 AM|Jalpa Panchal|LINK
You could try to use the registry key setting:
Create a DWORD entry called DisableServerHeader in the following Registry key and set the value to 1.
After adding the Registry key, restart the HTTP service using the net stop HTTP command and the net start HTTP command. If the HTTP service doesn’t start up then use the iisreset command. If that also doesn’t work then you can restart the server.
You could also use urlscan tool:
Install the URLScan in your machine by the below link.
After installing URLScan, open the URLScan.ini file typically located in the %WINDIR%\System32\Inetsrv\URLscan folder. After opening it, search for the key RemoveServerHeader. By default, it is set to 0, but to remove the Server header, change the value
to 1.Doing so will remove the Server header Server: Microsoft-IIS/7.5 from the User mode response.
changes made by URLScan at the global level apply to all of your sites. If you would like to set up this for a particular site then look at the following article (site filter section).
You could also use the below code in the web.config file:
<requestFiltering removeServerHeader ="true" />
Oct 10, 2019 07:11 AM|nkphuc700|LINK
Thank Jalpa for your time to post a long instruction.
Unfortunately, the suggestion does not work for responses returned from Reporting Services which is not handled by the IIS server. It just works for responses returned from IIS. I already verified it and here is my information.
Oct 10, 2019 07:19 AM|Jalpa Panchal|LINK
did you restart your machine after doing a registry setting?
Oct 10, 2019 07:41 AM|Jalpa Panchal|LINK
your issue is most likely to the asp.net related you could post it on asp.net forum.
Oct 10, 2019 09:55 AM|nkphuc700|LINK
Yes, I did
Oct 11, 2019 01:20 AM|Jalpa Panchal|LINK
As I said your issue is most likely to the asp.net related you could post it on asp.net forum.
thank you for understanding.