Updating security headers

Author: damienbod

content/StsServerIdentity/SecurityHeadersDefinitions.cs

@@ -0,0 +1,68 @@
+using Microsoft.AspNetCore.Builder;
+
+namespace StsServerIdentity
+{
+    public static class SecurityHeadersDefinitions
+    {
+        public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
+        {
+            var policy = new HeaderPolicyCollection()
+                .AddFrameOptionsDeny()
+                .AddXssProtectionBlock()
+                .AddContentTypeOptionsNoSniff()
+                .AddReferrerPolicyStrictOriginWhenCrossOrigin()
+                .RemoveServerHeader()
+                .AddCrossOriginOpenerPolicy(builder =>
+                {
+                    builder.SameOrigin();
+                })
+                .AddCrossOriginEmbedderPolicy(builder =>
+                {
+                    builder.RequireCorp();
+                })
+                .AddCrossOriginResourcePolicy(builder =>
+                {
+                    builder.SameOrigin();
+                })
+                .AddContentSecurityPolicy(builder =>
+                {
+                    builder.AddObjectSrc().None();
+                    builder.AddBlockAllMixedContent();
+                    builder.AddImgSrc().Self().From("data:");
+                    builder.AddFormAction().Self();
+                    builder.AddFontSrc().Self();
+                    builder.AddStyleSrc().Self().UnsafeInline();
+                    builder.AddBaseUri().Self();
+                    builder.AddScriptSrc().UnsafeInline(); //.WithNonce();
+                    builder.AddFrameAncestors().Self();
+                    // builder.AddCustomDirective("require-trusted-types-for", "'script'");
+                })
+                .RemoveServerHeader()
+                .AddPermissionsPolicy(builder =>
+                {
+                    builder.AddAccelerometer().None();
+                    builder.AddAutoplay().None();
+                    builder.AddCamera().None();
+                    builder.AddEncryptedMedia().None();
+                    builder.AddFullscreen().All();
+                    builder.AddGeolocation().None();
+                    builder.AddGyroscope().None();
+                    builder.AddMagnetometer().None();
+                    builder.AddMicrophone().None();
+                    builder.AddMidi().None();
+                    builder.AddPayment().None();
+                    builder.AddPictureInPicture().None();
+                    builder.AddSyncXHR().None();
+                    builder.AddUsb().None();
+                });
+
+            if (!isDev)
+            {
+                // maxage = one year in seconds
+                policy.AddStrictTransportSecurityMaxAgeIncludeSubDomains(maxAgeInSeconds: 60 * 60 * 24 * 365);
+            }
+
+            return policy;
+        }
+    }
+}

content/StsServerIdentity/Startup.cs

@@ -143,8 +143,11 @@ public void ConfigureServices(IServiceCollection services)
             });
         }
 
-        public void Configure(IApplicationBuilder app)
+        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
         {
+            app.UseSecurityHeaders(
+                SecurityHeadersDefinitions.GetHeaderPolicyCollection(env.IsDevelopment()));
+
             app.UseCookiePolicy();
 
             if (_environment.IsDevelopment())
@@ -157,22 +160,7 @@ public void Configure(IApplicationBuilder app)
                 app.UseExceptionHandler("/Home/Error");
             }
 
-            app.UseHsts(hsts => hsts.MaxAge(365).IncludeSubdomains());
-            app.UseXContentTypeOptions();
-            app.UseReferrerPolicy(opts => opts.NoReferrer());
-            app.UseXXssProtection(options => options.EnabledWithBlockMode());
-
-            app.UseCsp(opts => opts
-                .BlockAllMixedContent()
-                .StyleSources(s => s.Self())
-                .StyleSources(s => s.UnsafeInline())
-                .FontSources(s => s.Self())
-                .FrameAncestors(s => s.Self())
-                .ImageSources(imageSrc => imageSrc.Self())
-                .ImageSources(imageSrc => imageSrc.CustomSources("data:"))
-                .ScriptSources(s => s.Self())
-                .ScriptSources(s => s.UnsafeInline())
-            );
+           
 
             var locOptions = app.ApplicationServices.GetService<IOptions<RequestLocalizationOptions>>();
             app.UseRequestLocalization(locOptions.Value);
@@ -181,25 +169,7 @@ public void Configure(IApplicationBuilder app)
             // https://nblumhardt.com/2019/10/serilog-mvc-logging/
             app.UseSerilogRequestLogging();
 
-            app.UseStaticFiles(new StaticFileOptions()
-            {
-                OnPrepareResponse = context =>
-                {
-                    if (context.Context.Response.Headers["feature-policy"].Count == 0)
-                    {
-                        var featurePolicy = "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'";
-
-                        context.Context.Response.Headers["feature-policy"] = featurePolicy;
-                    }
-
-                    if (context.Context.Response.Headers["X-Content-Security-Policy"].Count == 0)
-                    {
-                        var csp = "script-src 'self';style-src 'self';img-src 'self' data:;font-src 'self';form-action 'self';frame-ancestors 'self';block-all-mixed-content";
-                        // IE
-                        context.Context.Response.Headers["X-Content-Security-Policy"] = csp;
-                    }
-                }
-            });
+            app.UseStaticFiles();
 
             app.UseRouting();
 

content/StsServerIdentity/StsServerIdentity.csproj

@@ -39,6 +39,8 @@
     <PackageReference Include="Serilog.Sinks.File" Version="5.0.0" />
     <PackageReference Include="Fido2" Version="2.0.2" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="3.1.18" />
+    <PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders" Version="0.16.0" />
+    <PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders.TagHelpers" Version="0.16.0" />
   </ItemGroup>
 
   <ItemGroup>