 |
VOOZH | about |
|
VOOZH | about |
dotnet add package Joonasw.AspNetCore.SecurityHeaders --version 6.0.0
NuGet\Install-Package Joonasw.AspNetCore.SecurityHeaders -Version 6.0.0
<PackageReference Include="Joonasw.AspNetCore.SecurityHeaders" Version="6.0.0" />
<PackageVersion Include="Joonasw.AspNetCore.SecurityHeaders" Version="6.0.0" />Directory.Packages.props
<PackageReference Include="Joonasw.AspNetCore.SecurityHeaders" />Project file
paket add Joonasw.AspNetCore.SecurityHeaders --version 6.0.0
#r "nuget: Joonasw.AspNetCore.SecurityHeaders, 6.0.0"
#:package Joonasw.AspNetCore.SecurityHeaders@6.0.0
#addin nuget:?package=Joonasw.AspNetCore.SecurityHeaders&version=6.0.0Install as a Cake Addin
#tool nuget:?package=Joonasw.AspNetCore.SecurityHeaders&version=6.0.0Install as a Cake Tool
This library allows you to add Content Security Policy, Strict Transport Security and Public Key Pin headers via middleware.
You can get the library from NuGet: https://www.nuget.org/packages/Joonasw.AspNetCore.SecurityHeaders
// Enable Strict Transport Security with a 30-day caching period
// Do not include subdomains
// Do not allow preload
app.UseStrictTransportSecurity(new HstsOptions(TimeSpan.FromDays(30), includeSubDomains: false, preload: false));
// Use certificate pinning with:
// - 30-day caching period
// - One pin in SHA-256 form
// - Report-Only = Invalid certificate should not be reported, but:
// - Report problems to /hpkp-report
app.UseHpkp(hpkp =>
{
hpkp.UseMaxAgeSeconds(30 * 24 * 60 * 60)
.AddSha256Pin("nrmpk4ZI3wbRBmUZIT5aKAgP0LlKHRgfA2Snjzeg9iY=")
.SetReportOnly()
.ReportViolationsTo("/hpkp-report");
});
// Content Security Policy
app.UseCsp(csp =>
{
// If nothing is mentioned for a resource class, allow from this domain
csp.ByDefaultAllow
.FromSelf();
// Allow JavaScript from:
csp.AllowScripts
.FromSelf() //This domain
.From("localhost:1591") //These two domains
.From("ajax.aspnetcdn.com");
// CSS allowed from:
csp.AllowStyles
.FromSelf()
.From("ajax.aspnetcdn.com");
csp.AllowImages
.FromSelf();
// HTML5 audio and video elemented sources can be from:
csp.AllowAudioAndVideo
.FromNowhere();
// Contained iframes can be sourced from:
csp.AllowFrames
.FromNowhere(); //Nowhere, no iframes allowed
// Allow AJAX, WebSocket and EventSource connections to:
csp.AllowConnections
.To("ws://localhost:1591")
.To("http://localhost:1591")
.ToSelf();
// Allow fonts to be downloaded from:
csp.AllowFonts
.FromSelf()
.From("ajax.aspnetcdn.com");
// Allow object, embed, and applet sources from:
csp.AllowPlugins
.FromNowhere();
// Allow other sites to put this in an iframe?
csp.AllowFraming
.FromNowhere(); // Block framing on other sites, equivalent to X-Frame-Options: DENY
// Do not block violations, only report
// This is a good idea while testing your CSP
// Remove it when you know everything will work
csp.SetReportOnly();
// Where should the violation reports be sent to?
csp.ReportViolationsTo("/csp-report");
// Do not include the CSP header for requests to the /api endpoints
csp.OnSendingHeader = context =>
{
context.ShouldNotSend = context.HttpContext.Request.Path.StartsWithSegments("/api");
return Task.CompletedTask;
};
});
Content Security Policy can be quite daunting. Here is a nice page to find out what the options do: https://content-security-policy.com/
For violation reports, I recommend using Scott Helme's Report URI service at https://report-uri.io/.
CSP allows you to also specify a nonce value, which makes it easier to have inline script and style elements like this on a page:
<head>
<script>
console.log("Hello");
</script>
<style>
h1 {
color: red;
}
</style>
</head>
To allow them without nonces, you might have to use the unsafe-inline option.
Instead of doing that, we can add the following service in Startup:
public void ConfigureServices(IServiceCollection services)
{
// ... other service registrations
// Add services necessary for nonces in CSP, 32-byte nonces
services.AddCsp(nonceByteAmount: 32);
}
Then you need to modify your CSP definition to include the nonce:
csp.AllowScripts
.FromSelf()
.From("localhost:1591")
.From("ajax.aspnetcdn.com")
.AddNonce(); //<----
csp.AllowStyles
.FromSelf()
.From("ajax.aspnetcdn.com")
.AddNonce(); //<-----
Then to use the nonce tag helper, we need to import it in _ViewImports.cshtml:
@addTagHelper *, Joonasw.AspNetCore.SecurityHeaders
Then we just need to use it in the Razor view:
<head>
<script asp-add-nonce="true">
console.log("Hello");
</script>
<style asp-add-nonce="true">
h1 {
color: red;
}
</style>
</head>
Now a unique nonce is generated every request and inserted into the CSP header + the elements you want.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net8.0 net8.0 is compatible. net8.0-android net8.0-android was computed. net8.0-browser net8.0-browser was computed. net8.0-ios net8.0-ios was computed. net8.0-maccatalyst net8.0-maccatalyst was computed. net8.0-macos net8.0-macos was computed. net8.0-tvos net8.0-tvos was computed. net8.0-windows net8.0-windows was computed. net9.0 net9.0 is compatible. net9.0-android net9.0-android was computed. net9.0-browser net9.0-browser was computed. net9.0-ios net9.0-ios was computed. net9.0-maccatalyst net9.0-maccatalyst was computed. net9.0-macos net9.0-macos was computed. net9.0-tvos net9.0-tvos was computed. net9.0-windows net9.0-windows was computed. net10.0 net10.0 was computed. net10.0-android net10.0-android was computed. net10.0-browser net10.0-browser was computed. net10.0-ios net10.0-ios was computed. net10.0-maccatalyst net10.0-maccatalyst was computed. net10.0-macos net10.0-macos was computed. net10.0-tvos net10.0-tvos was computed. net10.0-windows net10.0-windows was computed. |
Showing the top 5 NuGet packages that depend on Joonasw.AspNetCore.SecurityHeaders:
| Package | Downloads |
|---|---|
|
IIR.RazorComponents.USWDS
IIR's U.S. Web Design System (USWDS) Components for .NET 6 and Razor Pages |
|
|
IIR.SecurityHeaders.Core
A collection of middleware and methods for helping secure the headers for websites in .NET 6. |
|
|
Peppermint.AspNetCore.SecurityHeaders.Addons
Addons permissions-policy to aspnetcore-security-headers library. |
|
|
RezisFramework
Package Description |
|
|
DenevCloud.AspNetCore.Services.Security
Easy to use and simple ASP.NET Core services for hardening and securing your web applications or APIs. Examples and Github repo coming soon. |
Showing the top 1 popular GitHub repositories that depend on Joonasw.AspNetCore.SecurityHeaders:
| Repository | Stars |
|---|---|
|
exceptionless/Exceptionless
Exceptionless application
|
| Version | Downloads | Last Updated |
|---|---|---|
| 6.0.0 | 343,208 | 3/27/2025 |
| 5.0.0 | 1,180,441 | 9/13/2023 |
| 4.0.1 | 780,941 | 3/3/2022 |
| 3.0.0 | 1,188,530 | 10/24/2019 |
| 2.9.0 | 105,457 | 6/21/2019 |
| 2.8.1 | 108,195 | 1/1/2019 |
| 2.8.0 | 1,023 | 1/1/2019 |
| 2.7.0 | 86,611 | 8/11/2018 |
| 2.6.0 | 36,734 | 5/27/2018 |
| 2.5.1 | 5,215 | 5/1/2018 |
| 2.5.0 | 3,612 | 4/14/2018 |
| 2.4.1 | 1,779 | 4/14/2018 |
| 2.4.0 | 23,250 | 1/21/2018 |
| 2.3.0 | 2,955 | 1/6/2018 |
| 2.2.0 | 10,632 | 11/20/2017 |
| 2.1.0 | 8,550 | 10/29/2017 |
| 2.0.0 | 3,867 | 9/30/2017 |
| 1.1.2 | 15,490 | 7/14/2017 |
Remove support for .NET 6 and 7, add support for 8 and 9.