NetEscapades.AspNetCore.SecurityHeaders

To customize headers, instantiate a HeaderPolicyCollection and use its helper methods to add or modify policies. You can also add arbitrary headers using AddCustomHeader.

Common patterns include:

• Using AddDefaultSecurityHeaders() as a base and then overriding specific headers.
• Using the UseSecurityHeaders(Action<HeaderPolicyCollection> ...) overload for a more concise syntax.
• Using RemoveServerHeader() to strip the Server header.

public void Configure(IApplicationBuilder app)
{
    // Option 1: Explicitly creating the collection
    var policyCollection = new HeaderPolicyCollection()
        .AddDefaultSecurityHeaders()
        .AddStrictTransportSecurityMaxAgeIncludeSubDomains(maxAgeInSeconds: 63072000);

    app.UseSecurityHeaders(policyCollection);

    // Option 2: Using the Action overload (more terse)
    app.UseSecurityHeaders(policies =>
        policies
            .AddDefaultSecurityHeaders()
            .AddStrictTransportSecurityMaxAgeIncludeSubDomains(maxAgeInSeconds: 63072000)
    );
}

If your API returns only JSON, you may not need the full set of security headers provided by AddDefaultSecurityHeaders(). You can use AddDefaultApiSecurityHeaders() to apply a more focused subset of headers recommended by OWASP.

This method sets:

• X-Content-Type-Options: nosniff
• Strict-Transport-Security: max-age=31536000; (HTTPS only)
• X-Frame-Options: Deny
• Content-Security-Policy: default-src: none; frame-ancestors 'none'
• Referrer-Policy: no-referrer
• Permissions-Policy: A comprehensive list of disabled features (e.g., camera=(), geolocation=(), etc.)
• Cross-Origin-Opener-Policy: same-origin
• Cross-Origin-Embedder-Policy: require-corp
• Cross-Origin-Resource-Policy: same-site

public void Configure(IApplicationBuilder app)
{
    var policyCollection = new HeaderPolicyCollection()
        .AddDefaultApiSecurityHeaders();

    app.UseSecurityHeaders(policyCollection);
}

To verify the provenance of NetEscapades NuGet packages, you must first remove the .signature.p7s file added by nuget.org to reconstruct the original package.

1. Remove the signature file (Linux/macOS):

file="path/to/NetEscapades.AspNetCore.SecurityHeaders.1.3.1.nupkg"
zip -d $file .signature.p7s

2. Remove the signature file (PowerShell):

$file="path/to/NetEscapades.AspNetCore.SecurityHeaders.1.3.1.nupkg"
[Reflection.Assembly]::LoadWithPartialName('System.IO.Compression')
$stream = New-Object IO.FileStream($file, [IO.FileMode]::Open)
$zip    = New-Object IO.Compression.ZipArchive($stream, [IO.Compression.ZipArchiveMode]::Update)
$zip.Entries | ? { $_.Name -eq ".signature.p7s" } | % { $_.Delete() }
$zip.Dispose();

3. Verify with GitHub CLI:

gh attestation verify --owner andrewlock "NetEscapades.AspNetCore.SecurityHeaders.1.3.1.nupkg"

4. Verify SBOM attestations:

gh attestation verify --owner andrewlock --predicate-type https://cyclonedx.org/bom "NetEscapades.AspNetCore.SecurityHeaders.1.3.1.nupkg"

For scenarios like multi-tenancy where headers must change based on request data (e.g., a tenant ID in a header), use SetPolicySelector() on IServiceCollection.AddSecurityHeaderPolicies().

This method accepts a Func<PolicySelectorContext, IReadOnlyHeaderPolicyCollection>. The selector is invoked for every request.

Best Practice: Avoid creating a new HeaderPolicyCollection from scratch on every request. Instead, cache policies or use IReadOnlyHeaderPolicyCollection.Copy() to create a mutable copy of an existing policy to modify.

builder.Services.AddSecurityHeaderPolicies()
    .AddPolicy("TenantPolicy", p => p.AddCustomHeader("X-Tenant", "Default"))
    .SetPolicySelector((PolicySelectorContext ctx) =>
    {
        // Access DI services via HttpContext
        var services = ctx.HttpContext.RequestServices;
        var selector = services.GetRequiredService<TenantHeaderPolicyCollectionSelector>();
        var tenant = services.GetRequiredService<ITenant>();
        
        return selector.GetPolicy(tenant);
    });