public XfoMiddleware(AppFunc next, XFrameOptions options)
: base(next)
{
_config = options;
var headerGenerator = new HeaderGenerator();
_headerResult = headerGenerator.CreateXfoResult(_config);
}
public HeaderResult CreateXfoResult(IXFrameOptionsConfiguration xfoConfig,
IXFrameOptionsConfiguration oldXfoConfig = null)
{
if (oldXfoConfig != null && oldXfoConfig.Policy != XfoPolicy.Disabled &&
xfoConfig.Policy == XfoPolicy.Disabled)
{
return(new HeaderResult(HeaderResult.ResponseAction.Remove, HeaderConstants.XFrameOptionsHeader));
}
switch (xfoConfig.Policy)
{
case XfoPolicy.Disabled:
return(null);
case XfoPolicy.Deny:
return(new HeaderResult(HeaderResult.ResponseAction.Set, HeaderConstants.XFrameOptionsHeader, "Deny"));
case XfoPolicy.SameOrigin:
return(new HeaderResult(HeaderResult.ResponseAction.Set, HeaderConstants.XFrameOptionsHeader,
"SameOrigin"));
default:
throw new NotImplementedException("Apparently someone forgot to implement support for: " +
xfoConfig.Policy);
}
}
/// <summary>
/// Initializes a new instance of the <see cref="XFrameOptionsAttribute"/> class
/// </summary>
public XFrameOptionsAttribute()
{
_config = new XFrameOptionsConfiguration {
Policy = XfoPolicy.Deny
};
_configurationOverrideHelper = new HeaderConfigurationOverrideHelper();
_headerOverrideHelper = new HeaderOverrideHelper();
}
public XfoMiddleware(RequestDelegate next, XFrameOptions options)
: base(next)
{
_config = options;
var headerGenerator = new HeaderGenerator();
_headerResult = headerGenerator.CreateXfoResult(_config);
}
internal void SetXFrameoptionsOverride(HttpContextBase context, IXFrameOptionsConfiguration xFrameOptionsConfig)
{
var headerList = GetHeaderListFromContext(context);
var headerKey = HeaderConstants.XFrameOptionsHeader;
if (headerList.ContainsKey(headerKey))
headerList.Remove(headerKey);
headerList.Add(headerKey, xFrameOptionsConfig);
}
internal void SetXFrameoptionsOverride(HttpContext context, IXFrameOptionsConfiguration xFrameOptionsConfig)
{
var headerList = GetHeaderListFromContext(context);
var headerKey = HeaderConstants.XFrameOptionsHeader;
if (headerList.ContainsKey(headerKey))
{
headerList.Remove(headerKey);
}
headerList.Add(headerKey, xFrameOptionsConfig);
}
/// <summary>
/// Initializes a new instance of the <see cref="XFrameOptionsAttribute"/> class
/// </summary>
public XFrameOptionsAttribute()
{
_config = new XFrameOptionsConfiguration { Policy = XfoPolicy.Deny };
_configurationOverrideHelper = new HeaderConfigurationOverrideHelper();
_headerOverrideHelper = new HeaderOverrideHelper();
}
public HeaderResult CreateXfoResult(IXFrameOptionsConfiguration xfoConfig,
IXFrameOptionsConfiguration oldXfoConfig = null)
{
if (oldXfoConfig != null && oldXfoConfig.Policy != XfoPolicy.Disabled &&
xfoConfig.Policy == XfoPolicy.Disabled)
{
return new HeaderResult(HeaderResult.ResponseAction.Remove, HeaderConstants.XFrameOptionsHeader);
}
switch (xfoConfig.Policy)
{
case XfoPolicy.Disabled:
return null;
case XfoPolicy.Deny:
return new HeaderResult(HeaderResult.ResponseAction.Set, HeaderConstants.XFrameOptionsHeader, "Deny");
case XfoPolicy.SameOrigin:
return new HeaderResult(HeaderResult.ResponseAction.Set, HeaderConstants.XFrameOptionsHeader,
"SameOrigin");
default:
throw new NotImplementedException("Apparently someone forgot to implement support for: " +
xfoConfig.Policy);
}
}
internal void SetXFrameoptionsOverride(IHttpContextWrapper context, IXFrameOptionsConfiguration xFrameOptionsConfig)
{
context.GetNWebsecOverrideContext().XFrameOptions = xFrameOptionsConfig;
}
