How to remove Server HTTP Header from Sitecore GraphQL API response?

Question

The Sitecore GraphQL API endpoint is returning Server HTTP Header in its response which has information on the hosting web server (IIS). This is a security issue as it gives the attacker information to focus on specific infrastructure.

I tried to remove the header using a Web.config transform as suggested in Sitecore documentation below.

https://doc.sitecore.com/xp/en/developers/102/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html

However, this doesn't work for GraphQL endpoint. The Server header is not included in the responses from other Sitecore endpoints like Layout service or page routes. Do anyone know how to remove the Server header from GraphQL endpoint response?

Answer 1

Alternatively you can use a reverse proxy, such as IIS or Nginx, to remove the "Server" header from the response before it reaches the client. Hope it helps.

Answer 2

I know it's been almost a year since I asked this question but answering it myself as it might be useful to others. Because Sitecore's GeaphQL api is a asp.net core web api implementation you need to add the below web.config transform to set the removeServerHeader attribute on requestFiltering to true to remove the server header from response.

<?xml version="1.0" encoding="utf-8"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.webServer>
    <security>
      <requestFiltering removeServerHeader="true" xdt:Transform="SetAttributes" />
    </security>
  </system.webServer>
</configuration>