The Sitecore GraphQL API endpoint is returning Server HTTP Header in its response which has information on the hosting web server (IIS). This is a security issue as it gives the attacker information to focus on specific infrastructure.
I tried to remove the header using a Web.config transform as suggested in Sitecore documentation below.
However, this doesn't work for GraphQL endpoint. The Server header is not included in the responses from other Sitecore endpoints like Layout service or page routes. Do anyone know how to remove the Server header from GraphQL endpoint response?