Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://stackoverflow.com/q/1288338 below:

Why does ASP.NET framework add the 'X-Powered-By:ASP.NET' HTTP Header in responses?

Asked 15 years, 9 months ago

Viewed 10k times

I am just curious to know if there is a specific reason why the .Net Framework adds the 'X-Powered-By:ASP.NET' Http Header in its responses? Do other web servers (Apache, httpd) do the same thing?

EDIT: I know that it can be changed. I want to know if there is a reason to keep it or leave it as it is?

asked Aug 17, 2009 at 14:42

5,21855 gold badges3838 silver badges4444 bronze badges

I know that PHP does this. I guess there is no real purpose, other than marketing and making it easier for script kiddies to find suitable victims. For PHP it's better to disable the flag entirely since it shows the PHP version and therefore makes the server more vulnerable to attacks.

Edit: Who knows, it might also lead to better search results on bing... ;-)

answered Aug 17, 2009 at 14:48

33.3k3636 gold badges133133 silver badges215215 bronze badges

It is a default custom header when using IIS. It is a setting in IIS, you can change it if you wish.

Using IIS6 -

• Click on the HTTP Headers tab
• You can edit or remove the header in the Custom HTTP Headers box.

answered Aug 17, 2009 at 14:46

17.4k33 gold badges3838 silver badges3939 bronze badges

It is probably there so that sites like Netcraft can pull together statistics for the number of servers running IIS and ASP.NET. This used to be considered an important thing when .NET was released. By stating that n number of sites started using ASP.NET Microsoft could provide metrics for companies that only adopt technology based on the number of other users out there.

I don't believe there is a strong technical reason for having it since a PHP app could imitate an ASP.NET application, by setting the same header in Apache. I could imagine some naive client applications like FrontPage 2003, or SharePoint Designer might use headers like this to validate that they are indeed connecting to an ASP.NET enabled site but that is speculation on my part.

answered Aug 17, 2009 at 15:05

14.6k1515 gold badges6969 silver badges106106 bronze badges

It is fairly common to see a signature for the server/executing engine sent with the headers of a page whether you're running Apache and PHP or IIS and ASP.NET. Just acts as some free publicity, I suppose.

answered Aug 17, 2009 at 14:49

24.6k2020 gold badges101101 silver badges158158 bronze badges

"X-Powered-By:" isn't a standard header, but "Server: " is (and it clearly serves the same purpose).

In a world of SaaS and Cloud services, Web frameworks are 'strategic' assets, and every little piece of real-estate is advidly conquered... sometimes the cheating way.

54.3k5353 gold badges195195 silver badges242242 bronze badges

answered Aug 5, 2011 at 13:40

2111 bronze badge

Tomcat, Apache, WebSphere, JBoss, you name it..

Appearantly, it's not actually a standard HTTP header field.

answered Aug 17, 2009 at 14:59

19.6k99 gold badges4747 silver badges6464 bronze badges

If "Why" used in context of "how to change it" - go to IIS properties of your site ant open tab "HTTP Headers" and correct Custom HTTP Header.

answered Aug 17, 2009 at 14:47

23.7k1313 gold badges7777 silver badges126126 bronze badges

Start asking to get answers

Find the answer to your question by asking.

Explore related questions

See similar questions with these tags.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.3