title: How to remove x-powered-by header in .net core 2.0
body: <p>I tried to use this middleware:</p>
  
  <pre><code>public class SecurityHeadersMiddleware
  {
      private readonly RequestDelegate next;
  
      public SecurityHeadersMiddleware(RequestDelegate next)
      {
          this.next = next;
      }
  
      public async Task Invoke(HttpContext context)
      {
          context.Response.OnStarting(state =&gt;
          {
              var ctx = (HttpContext)state;
  
              if (!ctx.Response.Headers.ContainsKey("Arr-Disable-Session-Affinity"))
              {
                  ctx.Response.Headers.Add("Arr-Disable-Session-Affinity", "True"); // Disables the Azure ARRAffinity cookie
              }
  
              if (ctx.Response.Headers.ContainsKey("Server"))
              {
                  ctx.Response.Headers.Remove("Server"); // For security reasons
              }
  
              if (ctx.Response.Headers.ContainsKey("x-powered-by") || ctx.Response.Headers.ContainsKey("X-Powered-By"))
              {
                  ctx.Response.Headers.Remove("x-powered-by");
                  ctx.Response.Headers.Remove("X-Powered-By");
              }
  
              if (!ctx.Response.Headers.ContainsKey("X-Frame-Options"))
              {
                  ctx.Response.Headers.Add("X-Frame-Options", "DENY");
              }
  
              return Task.FromResult(0);
          }, context);
  
          await next(context);
      }
  }
  </code></pre>
  
  <p>x-powered-by is still there in response header which says asp.net</p>