Devops

Hiding IIS headers

IIS web server is exposing itself to outside by providing some response headers. That is nice however it leads to widening of attack surface, in terms of cybersecurity.

To hide response headers like "Powered by ASP.NET", we may just go into IIS Panel > Response Headers and remove it, or we may choose to update the web.config in the app root.

<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <!-- Remove headers -->
        <remove name="X-Powered-By" />
        <remove name="X-AspNet-Version" />
        <remove name="X-AspNetMvc-Version" />
        <!-- Optionally add your own custom header instead -->
        <!-- <add name="X-Custom-Header" value="MyApp" /> -->
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

sample web.config file for disabling iis headers

To hide "server: Microsoft IIS" header, there are a couple of ways to do it (using uri rewrite etc.), besides I think that the best approach is to use the command line. It is pretty much straightforward.

%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.webServer/security/requestFiltering /removeServerHeader:"True"  /commit:apphost

command line script to hide server header

Adding a new runner to Github Actions

We may bring our infrastructure into github and configure our own servers for a CI/CD pipeline The servers that do the heavylifting are called "runners", so we need to add runner into our Github Actions click on actions > new runner or directly use that link https:

Using a soap service in net core

We need to use svcutil tool to generate client for a soap client in .net core. Install it from CLI using the command below. dotnet tool install --global dotnet-svcutil Then you can check the version by --help parameter. dotnet-svcutil --help to generate a client stub for a soap service, we

Read more

Adding a new runner to Github Actions

Using a soap service in net core