https://github.com/gaprogman/owaspheaders.core
Inject OWASP recommended HTTP Headers for increased security in a single line
https://github.com/gaprogman/owaspheaders.core
application-security aspnetcore http-header middleware nuget owasp security
Last synced: about 2 months ago
JSON representation
Inject OWASP recommended HTTP Headers for increased security in a single line
- Host: GitHub
- URL: https://github.com/gaprogman/owaspheaders.core
- Owner: GaProgMan
- License: mit
- Created: 2017-06-06T23:06:42.000Z (about 8 years ago)
- Default Branch: main
- Last Pushed: 2025-03-21T23:57:21.000Z (4 months ago)
- Last Synced: 2025-04-14T20:55:21.284Z (3 months ago)
- Topics: application-security, aspnetcore, http-header, middleware, nuget, owasp, security
- Language: C#
- Homepage: https://www.nuget.org/packages/OwaspHeaders.Core/
- Size: 904 KB
- Stars: 302
- Watchers: 12
- Forks: 37
- Open Issues: 11
-
Metadata Files:
- Readme: README-NuGet.md
- Changelog: changelog.md
- Contributing: docs/Contributing.md
- License: LICENSE.txt
- Code of conduct: .github/CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
README
# OwaspHeaders.Core
An ASP .NET Core middleware for injection [OWASP](https://www.owasp.org/index.php/Main_Page) recommended HTTP Headers for increased security. This project is designed against the [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/).
## Quick Starts
1. Create a .NET (either Framework, Core, or 5+) project which uses ASP .NET Core
Example;
```bash
dotnet new webapi -n exampleProject
```
2. Add a reference to the OwaspHeaders.Core NuGet package.
Example:
```bash
dotnet add package OwaspHeaders.Core
```
3. Alter the program.cs file to include the following:
```csharp
app.UseSecureHeadersMiddleware();
```
This will add a number of default HTTP headers to all responses from your server component.
The following is an example of the response headers from version 9.0.0 (taken on November 19th, 2024)
```http
strict-transport-security: max-age=31536000;includesubdomains
x-frame-options: deny
x-content-type-options: nosniff
content-security-policy: script-src 'self';object-src 'self';block-all-mixed-content;upgrade-insecure-requests;
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
cross-origin-resource-policy: same-origin
cache-control: max-age=0,no-store
cross-origin-opener-policy: same-origin
cross-origin-embedder-policy: require-corp
x-xss-protection: 0
```
Please note: The above example contains only the headers added by the Middleware.
## Source Code Repo
The source code for this NuGet package can be found at: [https://github.com/GaProgMan/OwaspHeaders.Core](https://github.com/GaProgMan/OwaspHeaders.Core).
## Documentation
The documentation for this NuGet package can be found at: [https://gaprogman.github.io/OwaspHeaders.Core/](https://gaprogman.github.io/OwaspHeaders.Core/).
### Attestations
As of [PR 148](https://github.com/GaProgMan/OwaspHeaders.Core/pull/148), OwaspHeaders.Core uses the GitHub provided process for creating attestations per build. This document talks through how to verify those attestations using the [gh CLI](https://cli.github.com/).
See the [Attestations](https://gaprogman.github.io/OwaspHeaders.Core/attestations) page of the documentation to read about how you can verify the attestations for builds from 9.5.0 onward.
## Issues and Bugs
Please raise any issues and bugs at the above mentioned source code repo.
## Server Header: A Warning
The default configuration for this middleware removes the `X-Powered-By` header, as this can help malicious users to use targeted attacks for specific server infrastructure. However, since the `Server` header is added by the reverse proxy used when hosting an ASP .NET Core application, removing this header is out of scope for this middleware.
In order to remove this header, a `web.config` file is required, and the following should be added to it:
```xml
```
The above XML is taken from [this answer on ServerFault](https://serverfault.com/a/1020784).
The `web.config` file will need to be copied to the server when the application is deployed.