OwaspHeaders.Core 6.0.1

There is a newer version of this package available.
See the version list below for details.
dotnet add package OwaspHeaders.Core --version 6.0.1
NuGet\Install-Package OwaspHeaders.Core -Version 6.0.1
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="OwaspHeaders.Core" Version="6.0.1" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add OwaspHeaders.Core --version 6.0.1
#r "nuget: OwaspHeaders.Core, 6.0.1"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install OwaspHeaders.Core as a Cake Addin
#addin nuget:?package=OwaspHeaders.Core&version=6.0.1

// Install OwaspHeaders.Core as a Cake Tool
#tool nuget:?package=OwaspHeaders.Core&version=6.0.1

OwaspHeaders.Core

A .NET Core middleware for injecting the Owasp recommended HTTP Headers for increased security.

Build status

Build status

Release status

Release

Changelog

See the changelog file for a rough breakdown of the changes made to each of the major versions of the repo.

Licence Used

License: MIT

See the contents of the LICENSE file for details

Support This Project

If you have found this project helpful, either as a library that you use or as a learning tool, please consider buying me a coffee:

<a href="https://www.buymeacoffee.com/dotnetcoreshow" target="_blank"><img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee" style="height: 41px !important;width: 174px !important" ></a>

Code Triage Status

Code Triagers Badge

Code of Conduct

ClacksMiddleware has a Code of Conduct which all contributors, maintainers and forkers must adhere to. When contributing, maintaining, forking or in any other way changing the code presented in this repository, all users must agree to this Code of Conduct.

See Code of Conduct.md for details.

Pull Requests

PRs Welcome

Pull requests are welcome, but please take a moment to read the Code of Conduct before submitting them or commenting on any work in this repo.

NuGet package

OwaspHeaders.Core is now availble as a NuGet package. The NuGet package can be accessed here

Development Logs

This repository forms the basis for a series of blog posts that I have written on the topic of ASP.NET Core middleware.

If you would like to read about how I have developed the code in this repository, please see the first in the blog post series entitled: ".NET Core Middleware – OWASP Headers Part 1"

Description

A collection of ASP.NET Core middleware classes designed to increase web application security by adopting the recommended OWASP settings.

OwaspHeaders.Core logo

Secure Headers

The SecureHeadersMiddleware is used to inject the HTTP headers recommended by the OWASP Secure Headers project into all responses generated by the ASP.NET Core pipeline.

Usage

Add a reference to the NuGet package to your project

dotnet add package OwaspHeaders.Core

Configuration

For both versions 1.x and 2.x, a secureHeaderSettings.json file was used. However, from version 3.x onwards, a build-time builder pattern is now used for configuring the secure headers.

Please see the following sections for how to configure the OwaspHeaders.Core middlware.

Configuration in Version 3.x

Version 3.x of OwaspHaders.Core no longer uses the secureHeaderSettings.json file as this is a runtime dependency. It now uses the builder pattern to set up the header information, which is a compile time dependency.

In your Startup class, add a using statement for the OwaspHeaders.Core middleware

using OwaspHeaders.Core.Extensions;

Then in the Configure method, add the following

app.UseSecureHeadersMiddleware(SecureHeadersMiddlewareExtensions.BuildDefaultConfiguration());

This will use the default configuration for the OwaspHeaders.Core middleware. The method (found in /src/Extensions/SecureHeadersMiddlewareExtensions.cs) looks like this:

public static SecureHeadersMiddlewareConfiguration BuildDefaultConfiguration()
{
    return SecureHeadersMiddlewareBuilder
        .CreateBuilder()
        .UseHsts()
        .UseXFrameOptions()
        .UseXSSProtection()
        .UseContentTypeOptions()
        .UseContentDefaultSecurityPolicy()
        .UsePermittedCrossDomainPolicies()
        .UseReferrerPolicy()
        .Build();
}

In order to use a custom configuration, follow the same pattern (perhaps creating your own extension method to encapsulate it):

public static SecureHeadersMiddlewareConfiguration CustomConfiguration()
{
    return SecureHeadersMiddlewareBuilder
        .CreateBuilder()
        .UseHsts(1200, false)
        .UseXSSProtection(XssMode.oneReport, "https://reporturi.com/some-report-url")
        .UseContentDefaultSecurityPolicy()
        .UsePermittedCrossDomainPolicies(XPermittedCrossDomainOptionValue.masterOnly)
        .UseReferrerPolicy(ReferrerPolicyOptions.sameOrigin)
        .Build();
}

Then consume it in the following manner:

app.UseSecureHeadersMiddleware(CustomSecureHeaderExtensions.CustomConfiguration());
Configuration in Version 2.x

In the constructor for the Startup class, add a reference to a secureHeaderSettings.json

public Startup(IHostingEnvironment env)
{
    var builder = new ConfigurationBuilder()
    .SetBasePath(env.ContentRootPath)
    .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
    .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true)
    .AddJsonFile("secureHeaderSettings.json", optional:true, reloadOnChange: true)
    .AddEnvironmentVariables();
    Configuration = builder.Build();
}

The contents of the secureHeaderSettings.json file take the following format:

{
    "SecureHeadersMiddlewareConfiguration": {
        "UseHsts": "true",
        "HstsConfiguration": {
            "MaxAge": 42,
            "IncludeSubDomains": "true"
        },
        "UseHpkp": "true",
        "HPKPConfiguration" :{
            "PinSha256" : [
                "e927fad33f9eb96126896413502a1034be0ca379dec377fb891feb9ebc720e47"
                ],
            "MaxAge": 3,
            "IncludeSubDomains": "true",
            "ReportUri": "https://github.com/GaProgMan/OwaspHeaders.Core"
        },
        "UseXFrameOptions": "true",
        "XFrameOptionsConfiguration": {
            "OptionValue": "allowfrom",
            "AllowFromDomain": "com.gaprogman.dotnetcore"
        },
        "UseXssProtection": "true",
        "XssConfiguration": {
            "XssSetting": "oneReport",
            "ReportUri": "https://github.com/GaProgMan/OwaspHeaders.Core"
        },
        "UseXContentTypeOptions": "true",
        "UseContentSecurityPolicy": "true",
        "ContentSecurityPolicyConfiguration": {
            "BlockAllMixedContent": "true",
            "UpgradeInsecureRequests": "true"
        }
    }
}

(the above file is provided for illustration purposes)

Load the contents of the secureHeaderSettings.json into an instance of the SecureHeadersMiddlewareConfiguration in the Startup class' ConfigureServices method.

public void ConfigureServices(IServiceCollection services)
{
    // Add framework services
    // Add functionality to inject IOptions<T>
    services.AddOptions();

    // Add our Config object so it can be injected
    services.Configure<SecureHeadersMiddlewareConfiguration>(Configuration.GetSection("SecureHeadersMiddlewareConfiguration"));
}

Add the SecureHeadersMiddleware into the ASP.NET Core pipeline, in the Startup class' Configure method.

public void Configure(IApplicationBuilder app, IHostingEnvironment env,
    IOptions<SecureHeadersMiddlewareConfiguration> secureHeaderSettings)
{
    // Add SecureHeadersMiddleware to the pipeline
    app.UseSecureHeadersMiddleware(secureHeaderSettings.Value);
}
Testing the Middleware

Run the application, request one of the pages that it serves and view the headers for the page.

This can be done in Google Chrome, using the Dev tools and checking the network tab.

secure headers shown in network tab

Shown above in the Response Headers section of the Values response.

Product Compatible and additional computed target framework versions.
.NET net5.0 was computed.  net5.0-windows was computed.  net6.0 was computed.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
.NET Core netcoreapp2.0 was computed.  netcoreapp2.1 was computed.  netcoreapp2.2 was computed.  netcoreapp3.0 was computed.  netcoreapp3.1 was computed. 
.NET Standard netstandard2.0 is compatible.  netstandard2.1 was computed. 
.NET Framework net461 was computed.  net462 was computed.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
MonoAndroid monoandroid was computed. 
MonoMac monomac was computed. 
MonoTouch monotouch was computed. 
Tizen tizen40 was computed.  tizen60 was computed. 
Xamarin.iOS xamarinios was computed. 
Xamarin.Mac xamarinmac was computed. 
Xamarin.TVOS xamarintvos was computed. 
Xamarin.WatchOS xamarinwatchos was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (4)

Showing the top 4 NuGet packages that depend on OwaspHeaders.Core:

Package Downloads
wjsz-base

wjsz基础库

Whipstaff.AspNetCore

Re-usable logic for working with ASP.NET Core.

OwaspHeaders.IsolatedFunction

A .NET Core middleware for injecting the Owasp recommended HTTP Headers into Azure Isolated Functions

DojoTools

Toolkit for microservices designing developed by Pod2 in Bakery Net Dojo at Globant - Aug 2022

GitHub repositories (1)

Showing the top 1 popular GitHub repositories that depend on OwaspHeaders.Core:

Repository Stars
GaProgMan/OnionArch
A .NET Core demo application which uses the Onion Architecture
Version Downloads Last updated
8.0.0 19,119 12/3/2023
7.5.1 30,148 8/9/2023
7.5.0 24,004 6/7/2023
7.0.1 1,380 6/5/2023
7.0.0 160 6/5/2023
6.1.0 2,680 5/15/2023
6.0.5 359 5/15/2023
6.0.4 137 5/15/2023
6.0.3 143 5/15/2023
6.0.2 291 5/11/2023
6.0.1 135 5/11/2023
6.0.0 155 5/11/2023
5.0.0 184 5/11/2023
4.6.2 1,390 5/11/2023
4.6.1 141 5/11/2023
4.6.0 158 5/11/2023
4.5.1 178,817 5/15/2022
4.5.0 429 5/15/2022
4.4.0 40,304 4/8/2022
4.3.0 446 4/8/2022
4.2.0 414,327 12/31/2019
4.1.1 7,575 11/16/2019
4.1.0 1,906 10/23/2019
3.5.2 26,287 7/19/2019
3.5.1 552 7/19/2019
3.5.0 565 7/19/2019
3.4.1 556 7/19/2019
3.4.0 15,605 3/16/2019
3.3.2 27,865 5/1/2018
3.3.1 3,374 4/16/2018
3.3.0 1,945 4/16/2018
3.2.0 1,053 4/16/2018
3.1.2 1,071 4/16/2018
3.1.1 1,172 4/13/2018
3.1.0 1,135 4/7/2018
3.0.0.3 1,641 3/20/2018
3.0.0.2 1,075 3/20/2018
3.0.0.1 2,098 2/25/2018
3.0.0 1,131 2/17/2018
2.1.0 3,403 1/2/2018
2.0.0.1 1,466 11/23/2017
2.0.0 2,506 9/20/2017
1.6.0 1,120 8/15/2017
1.5.0 1,058 8/13/2017
1.0.1 1,208 7/25/2017
0.0.0.1 1,404 7/25/2017