OwaspHeaders.Core 7.5.1

.NET Standard 2.0
dotnet add package OwaspHeaders.Core --version 7.5.1
NuGet\Install-Package OwaspHeaders.Core -Version 7.5.1
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="OwaspHeaders.Core" Version="7.5.1" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add OwaspHeaders.Core --version 7.5.1
#r "nuget: OwaspHeaders.Core, 7.5.1"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install OwaspHeaders.Core as a Cake Addin
#addin nuget:?package=OwaspHeaders.Core&version=7.5.1

// Install OwaspHeaders.Core as a Cake Tool
#tool nuget:?package=OwaspHeaders.Core&version=7.5.1


An ASP .NET Core middleware for injection OWASP recommended HTTP Headers for increased security. This project is designed against the OWASP Secure Headers Project.

Quick Starts

  1. Create a .NET (either Framework, Core, or 5+) project which uses ASP .NET Core


dotnet new webapi -n exampleProject
  1. Add a reference to the OwaspHeaders.Core NuGet package.


dotnet add package OwaspHeaders.Core
  1. Alter the Startup (pre .NET 6) or program (post .NET 6) class to include the following:

This will add a number of default HTTP headers to all responses from your server component.

The following is an example of the response headers from version 6.0.2 (taken on May 15th, 2023)

cache-control: max-age=31536000, private
strict-transport-security: max-age=63072000;includeSubDomains
x-frame-options: DENY
x-xss-protection: 0
x-content-type-options: nosniff
content-security-policy: script-src 'self';object-src 'self';block-all-mixed-content;upgrade-insecure-requests;
x-permitted-cross-domain-policies: none;
referrer-policy: no-referrer

Please note: The above example contains only the headers added by the Middleware.

Source Code Repo

The source code for this NuGet package can be found at: https://github.com/GaProgMan/OwaspHeaders.Core.

Issues and Bugs

Please raise any issues and bugs at the above mentioned source code repo.

Server Header: A Warning

The default configuration for this middleware removes the X-Powered-By header, as this can help malicious users to use targeted attacks for specific server infrastructure. However, since the Server header is added by the reverse proxy used when hosting an ASP .NET Core application, removing this header is out of scope for this middleware.

In order to remove this header, a web.config file is required, and the following should be added to it:

<?xml version="1.0" encoding="UTF-8"?>
            <requestFiltering removeServerHeader="true" />

The above XML is taken from this answer on ServerFault.

The web.config file will need to be copied to the server when the application is deployed.

Product Compatible and additional computed target framework versions.
.NET net5.0 was computed.  net5.0-windows was computed.  net6.0 was computed.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
.NET Core netcoreapp2.0 was computed.  netcoreapp2.1 was computed.  netcoreapp2.2 was computed.  netcoreapp3.0 was computed.  netcoreapp3.1 was computed. 
.NET Standard netstandard2.0 is compatible.  netstandard2.1 was computed. 
.NET Framework net461 was computed.  net462 was computed.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
MonoAndroid monoandroid was computed. 
MonoMac monomac was computed. 
MonoTouch monotouch was computed. 
Tizen tizen40 was computed.  tizen60 was computed. 
Xamarin.iOS xamarinios was computed. 
Xamarin.Mac xamarinmac was computed. 
Xamarin.TVOS xamarintvos was computed. 
Xamarin.WatchOS xamarinwatchos was computed. 
Compatible target framework(s)
Additional computed target framework(s)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (5)

Showing the top 5 NuGet packages that depend on OwaspHeaders.Core:

Package Downloads



Package Description


Package Description


A .NET Core middleware for injecting the Owasp recommended HTTP Headers into Azure Isolated Functions


Toolkit for microservices designing developed by Pod2 in Bakery Net Dojo at Globant - Aug 2022

GitHub repositories (1)

Showing the top 1 popular GitHub repositories that depend on OwaspHeaders.Core:

Repository Stars
A .NET Core demo application which uses the Onion Architecture
Version Downloads Last updated
7.5.1 16,002 8/9/2023
7.5.0 17,734 6/7/2023
7.0.1 1,007 6/5/2023
7.0.0 129 6/5/2023
6.1.0 2,450 5/15/2023
6.0.5 330 5/15/2023
6.0.4 110 5/15/2023
6.0.3 117 5/15/2023
6.0.2 254 5/11/2023
6.0.1 110 5/11/2023
6.0.0 113 5/11/2023
5.0.0 142 5/11/2023
4.6.2 916 5/11/2023
4.6.1 112 5/11/2023
4.6.0 145 5/11/2023
4.5.1 152,388 5/15/2022
4.5.0 403 5/15/2022
4.4.0 39,382 4/8/2022
4.3.0 421 4/8/2022
4.2.0 395,692 12/31/2019
4.1.1 7,537 11/16/2019
4.1.0 1,895 10/23/2019
3.5.2 25,145 7/19/2019
3.5.1 523 7/19/2019
3.5.0 537 7/19/2019
3.4.1 528 7/19/2019
3.4.0 15,400 3/16/2019
3.3.2 27,596 5/1/2018
3.3.1 3,321 4/16/2018
3.3.0 1,906 4/16/2018
3.2.0 1,010 4/16/2018
3.1.2 1,036 4/16/2018
3.1.1 1,137 4/13/2018
3.1.0 1,104 4/7/2018 1,609 3/20/2018 1,045 3/20/2018 2,062 2/25/2018
3.0.0 1,101 2/17/2018
2.1.0 3,360 1/2/2018 1,434 11/23/2017
2.0.0 2,450 9/20/2017
1.6.0 1,078 8/15/2017
1.5.0 1,023 8/13/2017
1.0.1 1,165 7/25/2017 1,357 7/25/2017