Does not remove "X-AspNet-Version" when used in Azure Functions

[AranVinkItility]

Hi,

I'm using this extension on Azure Functions, and it does a great job of removing the "Server" and "X-Powered-By" response headers.

However it does not seem to remove the "X-AspNet-Version" response header when using Azure Functions.

I've also tried another extension that should do the same, without luck:
https://github.com/gregjhogan/remove-insecure-response-headers-site-extension

My guess now is that is has something to do with the way Azure Functions routes the requests internally. Are there any extra configuration options for this extension, or debugging steps I could try?

[tjrobinson]

@AranVinkItility Thanks for reporting this, that's an interesting one. I'll try and reproduce it but I suspect there's something about the way Azure Functions works that overrides the configuration in this extension. As you can see from the README for this project, what this extension is actually doing is very simple - applying a configuration transform. So there's nothing obvious I can think of that could be changed. I'll post an issue on the Azure Functions issue tracker and see if they can suggest anything.

This extension is very similar to the other you found. I have suggested that we merge the two extensions together but haven't had a response yet.

[tjrobinson]

Related:

• outboundRules that modify response headers don't seem to work projectkudu/kudu#1879
• Removal of X-AspNet-Version gregjhogan/remove-insecure-response-headers-site-extension#2

[AranVinkItility]

Hi, thanks for the quick reply, one of the related is actually the issue I filed with the other extension ;)

I'll file an issue report with Azure Functions to look into this. Seems like something that cannot be fixed on the 'extension' side.

[tjrobinson]

@AranVinkItility This is apparently now fixed: Azure/Azure-Functions#290

Let me know if this issue can now be closed.