Migrating this discussion from an email received from Mitch Howard.
Notes from Mitch Howard
Hi, Joe. Just a quick FWIW: When I've been deploying various Azure sites recently, I've been using NWebSec middleware
https://docs.nwebsec.com/en/latest/
https://www.dotnetnoob.com/2012/09/security-through-http-response-headers.html
to manage headers related to security such as: X-Frame-Options Strict-Transport-Security X-Content-Type-Options X-Download-Options X-XSS-Protection X-Content-Security-Policy / X-Content-Security-Policy-Report-Only Some headers are newer and still in beta, but others are well-established.
I've been using https://securityheaders.com/ to grade the sites after implementation. Since I know you to be very security-minded, I thought you might be interested in incorporating these into the stock Cloudscribe code.
For NWebSec, one only has to load the nuGet package and add a few lines of code in Configure().
If you prefer the Cloudscribe components to be entirely yours, rolling your own middleware to accomplish what you need isn't too complicated either.
For a test instance of Cloudscribe Core, I used this code:
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
app.UseDatabaseErrorPage();
}
else
{
app.UseExceptionHandler("/oops/error");
// Commented out delivered 3 lines
//if (_sslIsAvailable)
{ // app.UseHsts(); //} }
if (_sslIsAvailable)
{
#region NWebsec Security Headers Middleware extensions
// See: https://docs.nwebsec.com/en/latest/nwebsec/Configuring-csp.html#
// and https://damienbod.com/2018/02/08/adding-http-headers-to-improve-security-in-an-asp-net-mvc-core-application/
app.UseHsts(hsts => hsts.MaxAge(SecHdrOptions.HstsDays));
app.UseRedirectValidation(options => options.AllowSameHostRedirectsToHttps());
app.UseXContentTypeOptions();
app.UseReferrerPolicy(opts => opts.NoReferrer());
app.UseXXssProtection(options => options.EnabledWithBlockMode());
app.UseXfo(xfo => xfo.SameOrigin());
app.UseCsp(opts => opts
.BlockAllMixedContent()
.StyleSources(s => s.Self()
.UnsafeInline()
.CustomSources(SecHdrOptions.WhitelistStyles))
.FontSources(s => s.Self()
.CustomSources(SecHdrOptions.WhitelistFonts))
.FormActions(s => s.Self())
.FrameAncestors(s => s.Self())
.ImageSources(s => s.Self().CustomSources(SecHdrOptions.WhitelistImages))
.ScriptSources(s => s.Self()
.UnsafeInline()
.UnsafeEval()
.CustomSources(SecHdrOptions.WhitelistScripts)) );
#endregion
and this static class:
public static class SecHdrOptions
{
public const int HstsDays = 180;
// Whitelists for NWebsec Middleware
public static readonly string[] WhitelistScripts = new string[]
{
"https://google.com",
"https://ajax.googleapis.com",
"https://www.google-analytics.com",
"https://www.gstatic.com",
"https://cdnjs.cloudflare.com",
"https://www.google.com/recaptcha/"
};
public static readonly string[] WhitelistImages = new string[]
{
"https://cloudscribe.com",
"https://google.com",
"https://ajax.googleapis.com",
"https://www.google-analytics.com",
"data:",
"https://www.gstatic.com",
"https://cdnjs.cloudflare.com",
"https://secure.gravatar.com"
};
public static readonly string[] WhitelistFonts = new string[]
{
"https://fonts.googleapis.com",
"https://fonts.gstatic.com"
};
public static readonly string[] WhitelistStyles = new string[]
{
"https://google.com",
"https://fonts.googleapis.com",
"https://ajax.googleapis.com",
"https://www.gstatic.com",
"https://cdnjs.cloudflare.com" };
}
The whitelists could be kept in config files or the database. I hope this was helpful.