Skip to content

Instantly share code, notes, and snippets.

@AaronSadlerUK

AaronSadlerUK/HeaderPolicyCollection.cs

Last active December 2, 2021 18:05
Show Gist options
  • Save AaronSadlerUK/a6db2c2342f7390014be55d018a607c2 to your computer and use it in GitHub Desktop.
Save AaronSadlerUK/a6db2c2342f7390014be55d018a607c2 to your computer and use it in GitHub Desktop.
Download ZIP
Configuring HTTP Security Headers In Umbraco V9
Raw
HeaderPolicyCollection.cs
public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
{
var policy = new HeaderPolicyCollection()
.AddFrameOptionsDeny()
.AddXssProtectionBlock()
.AddContentTypeOptionsNoSniff()
.AddReferrerPolicyStrictOriginWhenCrossOrigin()
.RemoveServerHeader()
.AddCrossOriginOpenerPolicy(builder =>
{
builder.SameOrigin();
})
.AddCrossOriginEmbedderPolicy(builder =>
{
builder.RequireCorp();
})
.AddCrossOriginResourcePolicy(builder =>
{
builder.SameOrigin();
})
.AddContentSecurityPolicy(builder =>
{
builder.AddObjectSrc().None();
builder.AddBlockAllMixedContent();
builder.AddImgSrc().Self().From("data:");
builder.AddFormAction().Self();
builder.AddFontSrc().Self();
builder.AddStyleSrc().Self(); // .UnsafeInline();
builder.AddBaseUri().Self();
builder.AddScriptSrc().UnsafeInline().WithNonce();
builder.AddFrameAncestors().None();
})
.RemoveServerHeader()
.AddPermissionsPolicy(builder =>
{
builder.AddAccelerometer().None();
builder.AddAutoplay().None();
builder.AddCamera().None();
builder.AddEncryptedMedia().None();
builder.AddFullscreen().All();
builder.AddGeolocation().None();
builder.AddGyroscope().None();
builder.AddMagnetometer().None();
builder.AddMicrophone().None();
builder.AddMidi().None();
builder.AddPayment().None();
builder.AddPictureInPicture().None();
builder.AddSyncXHR().None();
builder.AddUsb().None();
});
if (!isDev)
{
// maxage = one year in seconds
policy.AddStrictTransportSecurityMaxAgeIncludeSubDomains(maxAgeInSeconds: 60 * 60 * 24 * 365);
}
return policy;
}
Raw
Startup.cs
app.UseSecurityHeaders(
SecurityHeadersDefinitions
.GetHeaderPolicyCollection(env.IsDevelopment()));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment