The goal of this project is to provide a set of services, helper functions and middleware that can be used to secure an ASP.NET Core application. All features are based on the Mozilla Web Security Guidelines.

Sidio.Web.Security.AspNetCore provides the ASP.NET Core services and middleware. The project targets .NET 8.0 and higher.

Sidio.Web.Security.Testing provides testing functionality that can be used to verify that the security headers are set correctly.

Sidio.Web.Security provides the core functionality. Can be used in projects targeting .NET Standard 2.0. It is useful to use this package if .NET Framework is still in use. Otherwise, use Sidio.Web.Security.AspNetCore. Note that this package does not contain the middleware and services that are provided by the ASP.NET Core package. Feel free to make a contribution to this project or a fork targeting .NET Framework.

See the wiki docs.

• Content-Security-Policy: docs
• Referrer-Policy: docs
• Report-To: docs
• Strict-Transport-Security (HSTS): docs
• X-Content-Type-Options: docs
• X-Frame-Options: docs

Read more in the wiki docs.

builder.Services
    .AddContentSecurityPolicy();

app.UseXFrameOptions();
app.UseXContentTypeOptions();
app.UseStrictTransportSecurity();
app.UseContentSecurityPolicy(
    (services, b) =>
    {
        b.AddDefaultSrc(x => x.AllowSelf());
        b.AddScriptSrc(x => x.AddNonce(services).AllowUnsafeInline().AllowUrl("https://cdn.example.com"));
        b.AddStyleSrc(x => x.AddNonce(services));
    });

See getting started and the recommended ASP.NET Core configuration.

The reporting API can be used to report violations of the Content Security Policy. Read more in the wiki docs.

• A secure cookie policy

The package Sidio.Web.Security.Testing provides a set of functions that can be used to test the security configuration of an ASP.Net Core application. Read more.

Contributions are welcome! Feel free to create a pull request or an issue.

This project is licensed under the MIT License.

Texts used in this project (including this readme, the code documentation and wiki pages) may come from, or be based on, the MDN Web Doc's. Documentation by Mozilla Contributors is licensed under CC-BY-SA 2.5.