A small ASP.NET Core middleware package for adding and customizing security headers to protect websites.
NetEscapades.AspNetCore.SecurityHeaders is a middleware package for ASP.NET Core that simplifies adding and configuring HTTP security headers to protect web applications. It helps prevent common vulnerabilities like clickjacking, MIME sniffing, and XSS by providing default headers and a fluent API for customization. The package supports headers such as Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options.
ASP.NET Core developers building web applications or APIs who need to implement security headers to comply with best practices and protect against web vulnerabilities. It's particularly useful for teams requiring fine-grained control over security policies.
Developers choose this package because it offers a straightforward, declarative way to add security headers with sensible defaults, reducing manual configuration errors. Its extensible design allows per-endpoint policies and dynamic header selection, making it adaptable to complex application architectures.
Small package to allow adding security headers to ASP.NET Core websites
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a safe set of default security headers like CSP, HSTS, and X-Frame-Options out of the box, reducing initial setup time and common configuration errors as noted in the README.
Offers a fluent API to easily add, remove, or modify individual security directives, demonstrated in examples like building Content-Security-Policy with builders for nonces and hashes.
Supports applying different security headers to specific endpoints or MVC actions using named policies or attributes, enabling granular control for complex applications.
Includes dedicated builders for Content-Security-Policy and Permissions-Policy headers, with optional TagHelpers for nonce and hash support to handle inline scripts and styles securely.
Configuring endpoint-specific headers or dynamic per-request policies requires multiple steps, such as calling AddSecurityHeaderPolicies() and careful middleware ordering, which can be cumbersome and error-prone.
The RemoveServerHeader method often fails because Kestrel adds the Server header late in the pipeline, necessitating separate Kestrel configuration as admitted in the README.
To use nonces or hashes with CSP, developers must install a separate NuGet package (NetEscapades.AspNetCore.SecurityHeaders.TagHelpers), adding complexity and an extra maintenance burden.