public override void OnResultExecuting(ResultExecutingContext context)
{
var result = context.Result;
if (result is ViewResult)
{
SecurityHeaderOptions options = context.HttpContext.RequestServices.GetService(typeof(SecurityHeaderOptions)) as SecurityHeaderOptions;
if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Type-Options"))
{
context.HttpContext.Response.Headers.Add("X-Content-Type-Options", options.XContentType);
}
if (!context.HttpContext.Response.Headers.ContainsKey("X-Frame-Options"))
{
context.HttpContext.Response.Headers.Add("X-Frame-Options", options.XFrame);
}
//var csp = "default-src 'self' 'unsafe-inline'";
// an example if you need client images to be displayed from twitter
//var csp = "default-src 'self'; img-src 'self' https://pbs.twimg.com";
// once for standards compliant browsers
if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
{
context.HttpContext.Response.Headers.Add("Content-Security-Policy", options.ContentSecurity);
}
// and once again for IE
if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Security-Policy"))
{
context.HttpContext.Response.Headers.Add("X-Content-Security-Policy", options.ContentSecurity);
}
}
}
public SecurityHeadersBuilder(SecurityHeaderOptions options)
{
_options = options;
}
public SecurityHeadersBuilder(IOptions <SecurityHeaderOptions> options)
{
_options = options.Value;
}
public SecurityHeaderMiddleware(RequestDelegate next, SecurityHeaderOptions securityHeaders)
{
_next = next ?? throw new ArgumentNullException(nameof(next));
_securityHeaders = securityHeaders ?? throw new ArgumentNullException(nameof(securityHeaders));
}