Header 'RESPONSE_Server' overridden following the OWASP security best practice

lorenzobruni · lorenzobruni · commit 7970cd34cc75 · 2020-02-26T08:29:03.000Z
diff --git a/test/Web.config b/test/Web.config
@@ -11,6 +11,12 @@
                     <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />
                 </rule>
             </rules>
+            <outboundRules>
+				<rule name="Hide Server Header">
+				  <match serverVariable="RESPONSE_Server" pattern=".+" />
+				  <action type="Rewrite" value="n/a" />
+				</rule>
+            </outboundRules>
         </rewrite>
     </system.webServer>
 </configuration>
