Removing/Hiding/Disabling excessive HTTP response headers in Azure/IIS7 without UrlScan

The following changes allow you to remove these HTTP response headers in Azure without writing a custom HttpModule. Most of the information on the net is out of date, and involves UrlScan (which has since been integrated into IIS7, but with the RemoveServerHeader=1 option removed). Below is the neatest solution I’ve found (thanks to this … Read more

What is “X-Content-Type-Options=nosniff”?

It prevents the browser from doing MIME-type sniffing. Most browsers are now respecting this header, including Chrome/Chromium, Edge, IE >= 8.0, Firefox >= 50 and Opera >= 13. See : https://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx?Redirected=true Sending the new X-Content-Type-Options response header with the value nosniff will prevent Internet Explorer from MIME-sniffing a response away from the declared content-type. EDIT: … Read more