The next generation of the Teknik Services. Written in ASP.NET. https://www.teknik.io/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

SecurityHeadersAttribute.cs 1.6KB

123456789101112131415161718192021222324252627282930313233343536373839
  1. using Microsoft.AspNetCore.Mvc;
  2. using Microsoft.AspNetCore.Mvc.Filters;
  3. namespace Teknik.IdentityServer.Security
  4. {
  5. public class SecurityHeadersAttribute : ActionFilterAttribute
  6. {
  7. public override void OnResultExecuting(ResultExecutingContext context)
  8. {
  9. var result = context.Result;
  10. if (result is ViewResult)
  11. {
  12. if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Type-Options"))
  13. {
  14. context.HttpContext.Response.Headers.Add("X-Content-Type-Options", "nosniff");
  15. }
  16. if (!context.HttpContext.Response.Headers.ContainsKey("X-Frame-Options"))
  17. {
  18. context.HttpContext.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
  19. }
  20. var csp = "default-src 'self';";
  21. // an example if you need client images to be displayed from twitter
  22. //var csp = "default-src 'self'; img-src 'self' https://pbs.twimg.com";
  23. // once for standards compliant browsers
  24. if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
  25. {
  26. context.HttpContext.Response.Headers.Add("Content-Security-Policy", csp);
  27. }
  28. // and once again for IE
  29. if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Security-Policy"))
  30. {
  31. context.HttpContext.Response.Headers.Add("X-Content-Security-Policy", csp);
  32. }
  33. }
  34. }
  35. }
  36. }