Security Headers

What are Security Headers?

Security headers are HTTP response headers that instruct browsers on how to behave securely.

Essential Security Headers

1. Content Security Policy (CSP)

app.Use(async (context, next) =>
{
    context.Response.Headers.Add("Content-Security-Policy",
        "default-src 'self'; " +
        "script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; " +
        "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; " +
        "img-src 'self' data: https:; " +
        "font-src 'self' https://cdnjs.cloudflare.com; " +
        "connect-src 'self' https://api.example.com; " +
        "frame-ancestors 'none'; " +
        "base-uri 'self'");
    await next();
});

2. X-Content-Type-Options

context.Response.Headers.Add("X-Content-Type-Options", "nosniff");

3. X-Frame-Options

context.Response.Headers.Add("X-Frame-Options", "DENY");

4. X-XSS-Protection

context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");

5. Referrer-Policy

context.Response.Headers.Add("Referrer-Policy", "strict-origin-when-cross-origin");

6. Strict-Transport-Security (HSTS)

context.Response.Headers.Add("Strict-Transport-Security", 
    "max-age=31536000; includeSubDomains; preload");

7. Permissions-Policy

context.Response.Headers.Add("Permissions-Policy", 
    "geolocation=(), microphone=(), camera=()");

Complete Security Headers Middleware

public class SecurityHeadersMiddleware
{
    private readonly RequestDelegate _next;
    
    public SecurityHeadersMiddleware(RequestDelegate next)
    {
        _next = next;
    }
    
    public async Task InvokeAsync(HttpContext context)
    {
        // Add security headers
        context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
        context.Response.Headers.Add("X-Frame-Options", "DENY");
        context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");
        context.Response.Headers.Add("Referrer-Policy", "strict-origin-when-cross-origin");
        
        // Add CSP (only if not development)
        if (!context.Request.Host.Host.Contains("localhost"))
        {
            context.Response.Headers.Add("Content-Security-Policy",
                "default-src 'self'; " +
                "script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; " +
                "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; " +
                "img-src 'self' data: https:; " +
                "font-src 'self' https://cdnjs.cloudflare.com; " +
                "connect-src 'self'");
        }
        
        // Add HSTS
        context.Response.Headers.Add("Strict-Transport-Security", 
            "max-age=31536000; includeSubDomains; preload");
        
        await _next(context);
    }
}

// Register middleware
app.UseMiddleware<SecurityHeadersMiddleware>();