We are excited to announce that the IIS.NET Forums are moving to the new Microsoft Q&A experience. Learn more >

Response headers from http.sysRSS

3 replies

Last post Apr 13, 2021 02:47 AM by samwu

  • Response headers from http.sys

    Apr 09, 2021 02:59 PM|dc31xx|LINK

    Some requests are not handled by IIS, but instead by http.sys. For example the path shown below:

    ❯ curl -sv http://localhost/..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5Cwindows%5C%5Cwin.ini 
    > GET /..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5Cwindows%5C%5Cwin.ini HTTP/1.1
    > ....
    < HTTP/1.1 403 Forbidden
    < Server: Microsoft-HTTPAPI/2.0

    Because IIS is not serving the request, the headers I configured in IIS (for example X-Content-Type-Options) are not added to the response. Is there any way to get around this? I need to have the the response headers added to every response, no matter the response code and/or the path.

  • Re: Response headers from http.sys

    Apr 12, 2021 02:02 AM|samwu|LINK

    Hi dc31xx,

    dc31xx

    Because IIS is not serving the request, the headers I configured in IIS (for example X-Content-Type-Options) are not added to the response. Is there any way to get around this? I need to have the the response headers added to every response, no matter the response code and/or the path.

    How did you try to add iis headers to the response? As far as I know, you can add it by iis url rewrite.

    https://www.iis.net/downloads/microsoft/url-rewrite

    Best regards,

    Sam

    IIS.NET forums are moving to a new home on Microsoft Q&A, we encourage you to go to Microsoft Q&A for .NET for posting new questions and get involved today. Learn more >
  • Re: Response headers from http.sys

    Apr 12, 2021 06:29 AM|dc31xx|LINK

    samwu

    How did you try to add iis headers to the response? As far as I know, you can add it by iis url rewrite.

    Unfortnately that does not work for the path I mention in the example. The response will be handled by http.sys before the rewrite rule kicks in.

  • Re: Response headers from http.sys

    Apr 13, 2021 02:47 AM|samwu|LINK

    Hi dc31xx,

    dc31xx

    Unfortnately that does not work for the path I mention in the example. The response will be handled by http.sys before the rewrite rule kicks in.

    According to my search and test, this is impossible to do.

    Best regards,

    Sam

    IIS.NET forums are moving to a new home on Microsoft Q&A, we encourage you to go to Microsoft Q&A for .NET for posting new questions and get involved today. Learn more >