Sidio.Web.Security.AspNetCore

ASP.NET Core web security

Goal of this project

The goal of this project is to provide a set of services, helper functions and middleware that can be used to secure an ASP.NET Core application. All features are based on the Mozilla Web Security Guidelines.

Packages

Sidio.Web.Security.AspNetCore

Sidio.Web.Security.AspNetCore provides the ASP.NET Core services and middleware. The project targets .NET 8.0 and higher.

Sidio.Web.Security.Testing

Sidio.Web.Security.Testing provides testing functionality that can be used to verify that the security headers are set correctly.

.NET Framework support: Sidio.Web.Security

Sidio.Web.Security provides the core functionality. Can be used in projects targeting .NET Standard 2.0. It is useful to use this package if .NET Framework is still in use. Otherwise, use Sidio.Web.Security.AspNetCore. Note that this package does not contain the middleware and services that are provided by the ASP.NET Core package. Feel free to make a contribution to this project or a fork targeting .NET Framework.

Code quality

Documentation

See the wiki docs.

Features

HTTP headers

• Content-Security-Policy: docs
• Referrer-Policy: docs
• Report-To: docs
• Strict-Transport-Security (HSTS): docs
• X-Content-Type-Options: docs
• X-Frame-Options: docs

Read more in the wiki docs.

Example

builder.Services
    .AddContentSecurityPolicy();

app.UseXFrameOptions();
app.UseXContentTypeOptions();
app.UseStrictTransportSecurity();
app.UseContentSecurityPolicy(
    (services, b) =>
    {
        b.AddDefaultSrc(x => x.AllowSelf());
        b.AddScriptSrc(x => x.AddNonce(services).AllowUnsafeInline().AllowUrl("https://cdn.example.com"));
        b.AddStyleSrc(x => x.AddNonce(services));
    });

See getting started and the recommended ASP.NET Core configuration.

Reporting API

The reporting API can be used to report violations of the Content Security Policy. Read more in the wiki docs.

Default policies

• A secure cookie policy

Testing

The package Sidio.Web.Security.Testing provides a set of functions that can be used to test the security configuration of an ASP.Net Core application. Read more.

Upgrade to version 2.x

In version 2.x the IDistributedCache is replaced by the HybridCache:

• SubresourceIntegrityOptions: the property AbsoluteExpiration is removed and replaced by LocalCacheExpiration and CacheExpiration

Contributions

Contributions are welcome! Feel free to create a pull request or an issue.

License

This project is licensed under the MIT License.

Texts used in this project (including this readme, the code documentation and wiki pages) may come from, or be based on, the MDN Web Doc's. Documentation by Mozilla Contributors is licensed under CC-BY-SA 2.5.