Brickmakers.AspSecurityHeaders 1.2.2

Prefix Reserved
There is a newer version of this package available.
See the version list below for details.
dotnet add package Brickmakers.AspSecurityHeaders --version 1.2.2                
NuGet\Install-Package Brickmakers.AspSecurityHeaders -Version 1.2.2                
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Brickmakers.AspSecurityHeaders" Version="1.2.2" />                
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add Brickmakers.AspSecurityHeaders --version 1.2.2                
#r "nuget: Brickmakers.AspSecurityHeaders, 1.2.2"                
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install Brickmakers.AspSecurityHeaders as a Cake Addin
#addin nuget:?package=Brickmakers.AspSecurityHeaders&version=1.2.2

// Install Brickmakers.AspSecurityHeaders as a Cake Tool
#tool nuget:?package=Brickmakers.AspSecurityHeaders&version=1.2.2                

BRICKMAKERS ASP.Net Security Headers

License CI-Pipeline Nuget Version Nuget Downloads

A small package for ASP.Net (Core) to automatically configure secure HTTP-Headers.

<small><i><a href=''>Table of contents generated with markdown-toc</a></i></small>


  • Secure defaults for HTTP-Headers, CSP, Cookies and more
  • Opt-Out mechanism for different security controls
  • Easily configurable via IApplicationBuilder.UseBmSecurityHeaders() extension
    • Or use IApplicationBuilder.UseBmApiSecurityHeaders() for API-Projects
  • Developed and Maintained by the BRICKMAKERS Security Advisory Team
  • Easy integration in any project and build pipelines


This package is available on, you can simply add it to your C#-Project like any other dependency.


To get started, all you have to to is to register the middleware in the Configure method. This should happen at the beginning of the method to ensure the headers are added to all responses, as different middlewares might end processing early, which would prevent the headers from being set:

public void Configure(IApplicationBuilder app)
    // ! Should be the first step in the Configure method

    // For "normal" Websites or combinations of Websites and APIs

    // For pure APIs

    // continue as usual with configuring the application
    // ...

This will add all security headers, as well as a strict CSP and cookie policy. To further configure it and opt out of certain security controls, you can use the configure parameter of the method. In the following example, scripts, styles and images are allowed to be loaded from the current origin and the minimum cookie same site requirements are reduced to be lax instead of strict.

public void Configure(IApplicationBuilder app)
    app.UseBmSecurityHeaders(collection => collection  // Or .UseBmApiSecurityHeaders for APIs
        .AddBmContentSecurityPolicy(builder =>

    // ...

Using the Built-In CSP Report Controller

The library includes a ready-made API-Controller to automatically report CSP-Violations. It will provide an endpoint to be used by the browser to report CSP errors and log them as error message. If you want to use the controller, there are a few steps that need to be taken.

First, you have to add the controller to the MVC instance inside of the ConfigureServices method. Typically, the AddMvc method is used, but you can also use any other of the MVC initializers, like for example AddControllers in case of a pure API.

public void ConfigureServices(IServiceCollection services)
        // works on .AddRazorPages() and .AddControllers() as well

In the case that this is the first controller you add to your project, you also need to ensure that controllers are correctly mapped to endpoints. You can do so via the UseEndpoints method at the end of Configure:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    // do your normal setup
    // ...

    // at the end, UseEndpoints should already exist
    app.UseEndpoints(endpoints =>
        // this one must be present
        // other mappings, e.g. MapRazorPages, depends on your application
        // ...

Finally, you need to actually set the report URI in the CSP. This can be done by adding it inside the CSP builder of the UseBmSecurityHeaders by adding AddBmReportController to the CSP. This automatically sets the report uri to the CSP controller on this server.

public void Configure(IApplicationBuilder app)
    app.UseBmSecurityHeaders(collection => collection  // Or .UseBmApiSecurityHeaders for APIs
        .AddBmContentSecurityPolicy(builder =>
            // setup your CSP
            // ...

    // ...

In case you also have additional projects that should also report to this controller, or in case you separate API and web project, the controller will always be accessible via https://<host>/CspReport. You can use it as any other CSP reporting endpoint.

Attributions & Background

This project is heavily based on NetEscapades.AspNetCore.SecurityHeaders, thanks to everyone involved on that project.

The reason this package exists is because it enforces even stricter defaults than the original package and adds additional features. It has not been integrated into the original security headers, as some of these feature would be breaking changes and too strict for some users.

However, we at BRICKMAKERS prefer to use tight secure defaults, which is why we created this package. It will always set everything to no by default and may add new, even more restricting headers in the future.

Product Compatible and additional computed target framework versions.
.NET net5.0 is compatible.  net5.0-windows was computed.  net6.0 is compatible.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
.NET Core netcoreapp3.1 is compatible. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (2)

Showing the top 2 NuGet packages that depend on Brickmakers.AspSecurityHeaders:

Package Downloads

An Orchard Core MVC module to automatically configure secure HTTP-Headers.


A small package for ASP.Net (Core) to automatically configure secure HTTP-Headers.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
2.5.1 3,508 9/12/2023
2.5.0 157 9/12/2023
2.4.0 1,466 6/22/2023
2.3.0 283 6/13/2023
2.2.1 4,469 12/15/2022
2.2.0 517 12/8/2022
2.1.0 424 12/5/2022
2.0.0 12,767 3/22/2022
1.3.1 850 2/3/2022
1.3.0 601 2/2/2022
1.2.2 681 1/26/2022

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](, and this project adheres
to [Semantic Versioning](

## [1.2.2] - 2022-01-26

### Added

- Added package icon

## [1.2.1] - 2022-01-26

### Changed

- First public release on GitHub and

## [1.2.0] - 2021-12-21

### Added

- `CspReportController`: Easily report CSP violations via the built-in controller
- Integration Tests
- Support for .Net 6

## [1.1.0] - 2021-10-21

### Added

- `UseBmApiSecurityHeaders`: Add Configuration method for pure APIs

## [1.0.2] - 2021-10-12

### Security

- Disable HSTS preload by default

## [1.0.1] - 2021-10-11

### Added

- Initial Release

## [Unreleased]

### Added

### Changed

### Deprecated

### Removed

### Fixed

### Security