title: Remove Server from HTTP Response in WCF
body: <p>I have an internet exposed WCF service running on IIS 7.5 that I need to secure.
  I would like to remove the "Server" header in the HTTP response.</p>
  
  <p>I've implemented an IDispatchMessageInspector with code as follows.</p>
  
  <pre><code>public void BeforeSendReply(ref Message reply, object correlationState)
  {
      var context = WebOperationContext.Current;
      if (context != null)
      {
          context.OutgoingResponse.Headers.Remove(
              HttpResponseHeader.Server);
      }
  }
  </code></pre>
  
  <p>However, the Server header is still in the response.
  On debugging I can see that the <code>OutgoingResponse.Headers</code> does not include <code>HttpResonseHead.Server</code>, and if I write my own value it is clearly being overriten by something further down the line in the IIS pipeline.</p>
  
  <p><strong>Edit 1</strong></p>
  
  <p>Tried the following, no good either</p>
  
  <pre><code>public class SecureServerHeaderModule : IHttpModule
  {
      #region Implementation of IHttpModule
  
      public void Init(HttpApplication context)
      {
          context.PreSendRequestHeaders += OnPreSendRequestHeaders;
      }
  
      public void Dispose() { }
  
      #endregion
  
      private static void OnPreSendRequestHeaders(object sender, EventArgs e)
      {
          var context = HttpContext.Current;
          if (context != null)
          {
              context.Response.Headers.Remove("Server");                
          }
      }
  }
  
  &lt;system.web&gt;
    &lt;httpModules&gt;
      &lt;add "snip" /&gt;
    &lt;/httpModlules&gt;
  &lt;/system.web&gt;
  &lt;system.webServer&gt;
    &lt;modules&gt;
      &lt;add "snip" /&gt;
    &lt;/modlules&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p><strong>Edit 2</strong></p>
  
  <p>Also did not work.</p>
  
  <pre><code>public void BeforeSendReply(ref Message reply, object correlationState)
  {
      var context = OperationContext.Current;
      if (context != null)
      {
          context.OutgoingMessageProperties.Remove(
              HttpResponseHeader.Server.ToString());
          context.OutgoingMessageProperties.Add(
              HttpResponseHeader.CacheControl.ToString(), "no-store");
      }
  }
  </code></pre>