SecHdrsCore 1.0.11

Security Headers - for ASP.Net Core.

Build up Security Headers in a (semi) modular way.
To use in an ASP.Net Core web project.
In startup.cs - add the following private members to the startup class
       private SecurityHeaders _securityHeaders { get; set; }
       private List<CspFrame> _cspFrames { get; set; }

And the following two private methods (and alter as you need to).  These do reference the samples nuget package.
       private List<CspFrame> AssembleContentSecurityPolicies()
       {
           var defCspFrame = new CspFrame().Initialise("default");
           defCspFrame.Clauses
               .AddUpdateClause("script-src", "", "'unsafe-eval'")
               .AddUpdateClause("style-src", "", "'unsafe-inline'")
               .AddUpdateClause("img-src", "", "data:")
               .AddUpdateClause("plugin-types", "", "application/pdf")
               .AddUpdateClause("frame-ancestors", "", "'none'")
               .AddUpdateClause("report-uri", "", "/cspreport");

           var basicCdnCspFrame = new CspFrame().Initialise("basicCdn");
           basicCdnCspFrame.Clauses
               .AddUpdateClause("default-src", "", "https://maxcdn.bootstrapcdn.com/")
               .AddUpdateClause("script-src", "", "https://ajax.googleapis.com/ https://code.jquery.com/ https://cdnjs.cloudflare.com/")
               .AddUpdateClause("style-src", "", "https://fonts.googleapis.com/")
               .AddUpdateClause("font-src", "", "https://fonts.gstatic.com/")
               .AddUpdateClause("img-src", "", "https://csi.gstatic.com/");

           var googleMapsCspFrame = new CspFrame().GoogleMaps();
           var stripeCspFrame = new CspFrame().Stripe();

           return new List<CspFrame>
           {
               defCspFrame,
               basicCdnCspFrame,
               googleMapsCspFrame,
               stripeCspFrame
           };
       }

       /// <summary>
       /// Returns a merged copy of all relevant CspFrames - adding in the Dev CspFrame if required
       /// </summary>
       /// <param name="env"></param>
       /// <returns></returns>
       private CspFrame BuildContentSecurityPolicy(IHostingEnvironment env)
       {
           if (_cspFrames == null || !_cspFrames.Any())
           {
               _cspFrames = AssembleContentSecurityPolicies();
           }

           // Assemble the master CSP
           var masterCsp = _cspFrames.Merge();

           if (env.IsDevelopment())
           {
               var localhostSp = "localhost:56993/";
               var stripe = "http://checkout.stripe.com/";

               // Note that this dev CSP includes the http versions for Stripe
               var devCspFrame = new CspFrame().Initialise("dev");
               devCspFrame.Clauses.AddUpdateClause("default-src", "", "http://localhost:5000/")
                   .AddUpdateClause("connect-src", "", "http://" + localhostSp + " ws://" + localhostSp + " " + stripe)
                   .AddUpdateClause("script-src", "", "http://" + localhostSp + " " + stripe);

               masterCsp = masterCsp.Merge(devCspFrame);
           }

           return masterCsp;
       }

Finally include the following in the configuration method just before app.UseMvc( ...
           // Set up the overall Security Headers
           // This will also assemble the _cspFrames object if required
           if (_securityHeaders == null)
           {
               _securityHeaders = app.BuildSecurityHeaders(BuildContentSecurityPolicy(env));
           }
           else
           {
               _securityHeaders.Csp = BuildContentSecurityPolicy(env);
           }
           app.UseSecurityHeaders(_securityHeaders);

Install-Package SecHdrsCore -Version 1.0.11
dotnet add package SecHdrsCore --version 1.0.11
<PackageReference Include="SecHdrsCore" Version="1.0.11" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add SecHdrsCore --version 1.0.11
The NuGet Team does not provide support for this client. Please contact its maintainers for support.

Release Notes

Does not currently provide specific support for manipulating Cookies or adding Subresource Integrity information for CDN based resources.  See SecHdrsCore.Sample for several sample CSP Frames.

This package is not used by any popular GitHub repositories.

Version History

Version Downloads Last updated
1.0.11 436 7/14/2017