tpeczek / lib.aspnetcore.security Goto Github PK

Lib.AspNetCore.Security is a library which provides security features like Content Security Policy, Strict Transport Security or Expect-CT for ASP.NET Core

License: MIT License

C# 100.00%

asp-net-core security hsts csp

lib.aspnetcore.security's Introduction

Lib.AspNetCore.Security

Lib.AspNetCore.Security is a library which provides security features like Content Security Policy, Strict Transport Security or Expect-CT for ASP.NET Core

Getting Started

You can get Lib.AspNetCore.Security and Lib.AspNetCore.Mvc.Security from NuGet.

PM>  Install-Package Lib.AspNetCore.Security

PM>  Install-Package Lib.AspNetCore.Mvc.Security

Documentation

The documentation is available here.

There are also blog posts available describing key features of the library (some of them have been written in context of ASP.NET MVC or previous versions of this library but the core idea haven't changed):

Demos

The demo project is available here.

Donating

My blog and open source projects are result of my passion for software development, but they require a fair amount of my personal time. If you got value from any of the content I create, then I would appreciate your support by sponsoring me (either monthly or one-time).

Copyright and License

Licensed under the MIT License

lib.aspnetcore.security's People

Contributors

Stargazers

Watchers

Forkers

senthil-curated-ref 109163101120 markchipman jords1987 den-dp

lib.aspnetcore.security's Issues

Add middleware for Content Security Policy reporting

Add support for HTTP Public Key Pinning

More details:

Adding directly to the CSP sources from controller

Hi,

Just downloaded this porject and it looks great, want to know if it will accomodate one of my requirements... I have a controller that is returning
return Content(<html><script>{window.top.location.href = \" Request.Scheme}://{Request.Host}/Error/Index\"}</script><body></body></html>

This is being used to break out of an iframe.

I want to be able to generate the hash for this and add it to the CSP header on the fly.

Can you think of a way to achieve this with this library.

Thanks for any help

Add Ability for Providing Conditions for Handling Requests by Content-Security-Policy and Content-Security-Policy-Report-Only Violation Reports Endpoint

Add support for plugin-types directive in Content Security Policy

More details:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/plugin-types

Add Support for Permissions Policy and Mark Feature Policy Related APIs as Obsolete

More details:

Add support for X-Content-Type-Options header

More details:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

Add support for X-Frame-Options header

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Add ContentSecurityPolicySourceListBuilder

More details:

https://www.w3.org/TR/CSP/#framework-directive-source-list

BLOCKS: #4

Would you consider contributing to NWebSec?

I've been using NWebSec for some time for security related HTTP headers etc. as it's pretty comprehensive and popular. Both NWebSec and your library have a fair amount of overlap while still having some features missing in both. Would you consider contributing to NWebSec to produce a one-stop shop for all your ASP.NET Core security needs? In particular I'm thinking about:

Add support for X-Permitted-Cross-Domain-Policies header

HTTP header used for informing Adobe products (PDF, Flash) as to how to handle cross domain policies. Allowed directives:

none - No policy files are allowed anywhere on the target server, including this master policy file.
master-only - Only this master policy file is allowed.
by-content-type - Only policy files served with Content-Type: text/x-cross-domain-policy are allowed.
all - All policy files on this target domain are allowed.

Add support for worker-src directive in Content Security Policy

More details:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src

Add middleware for Expect-CT reporting

Add support for block-all-mixed-content directive in Content Security Policy

More details:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content

Add support for strict-dynamic directive in Content Security Policy

More details:

DEPENDS ON: #21

Add support for frame-src directive in Content Security Policy

More details:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src

Add support for Referrer-Policy header

More details:

Feedback

This issue is for general feedback regarding this project.

Add support for X-Download-Options header

The IE/Edge only HTTP header with one possible directive: X-Download-Options: noopen, which instructs the browser not to open a download directly in the browser, but instead to provide only the ‘Save’ option.

Add support for Feature-Policy header

More details:

Add support for require-sri-for directive in Content Security Policy

More details:

Add support for Clear-Site-Data header

More details:

Make nonce-source generation secure

The current generation of nonce-source is not secure. From specification:

The generated value SHOULD be at least 128 bits long (before encoding), and SHOULD be generated via a cryptographically secure random number generator in order to ensure that the value is difficult for an attacker to predict.

Add support for Expect-CT header

https://scotthelme.co.uk/a-new-security-header-expect-ct/
https://datatracker.ietf.org/doc/draft-stark-expect-ct/?include_text=1

Add support for SHA384 and SHA512 hash algorithms in Content Security Policy

More details:

https://www.w3.org/TR/CSP/#grammardef-hash-source

Add hashes caching support in Content Security Policy tag helper

Currently the Content Security Policy tag helper is generating the hash every time, but in case where the content of style or script element is constant the hash could be cached. The desire to cache the hash could be indicated by providing cache vale for tag helper attribute: asp-csp="cache"