public override void OnResultExecuting(ResultExecutingContext context) { var result = context.Result; if (result is ViewResult) { SecurityHeaderOptions options = context.HttpContext.RequestServices.GetService(typeof(SecurityHeaderOptions)) as SecurityHeaderOptions; if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Type-Options")) { context.HttpContext.Response.Headers.Add("X-Content-Type-Options", options.XContentType); } if (!context.HttpContext.Response.Headers.ContainsKey("X-Frame-Options")) { context.HttpContext.Response.Headers.Add("X-Frame-Options", options.XFrame); } //var csp = "default-src 'self' 'unsafe-inline'"; // an example if you need client images to be displayed from twitter //var csp = "default-src 'self'; img-src 'self' https://pbs.twimg.com"; // once for standards compliant browsers if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy")) { context.HttpContext.Response.Headers.Add("Content-Security-Policy", options.ContentSecurity); } // and once again for IE if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Security-Policy")) { context.HttpContext.Response.Headers.Add("X-Content-Security-Policy", options.ContentSecurity); } } }
public SecurityHeadersBuilder(SecurityHeaderOptions options) { _options = options; }
public SecurityHeadersBuilder(IOptions <SecurityHeaderOptions> options) { _options = options.Value; }
public SecurityHeaderMiddleware(RequestDelegate next, SecurityHeaderOptions securityHeaders) { _next = next ?? throw new ArgumentNullException(nameof(next)); _securityHeaders = securityHeaders ?? throw new ArgumentNullException(nameof(securityHeaders)); }