This guide walks through implementing security headers in ASP.NET Core applications. We'll start with manual implementation to understand what each header does, then introduce a middleware library that provides secure defaults with a clean, fluent API. By the end, you'll have a properly secured application with protection against clickjacking, XSS, MIME sniffing, and other common web vulnerabilities. ## Table of Contents 1. [Prerequisites](#prerequisites) 2. [Understanding Security Headers](#understanding-security-headers) 3. [Manual Implementation](#manual-implementation) 4. [Content Security Policy Deep Dive](#content-security-policy-deep-dive) 5. [Environment-Aware Configuration](#environment-aware-configuration) 6. [Using SecurityMiddleware Library](#using-securitymiddleware-library) 7. [Testing Your Configuration](#testing-your-configuration) 8. [Common Scenarios and Solutions](#common-scenarios-and-solutions) 9. [Troubleshooting](#troubleshooting) --- ## Prerequisites - .NET 6.0 or later - Basic understanding of ASP.NET Core middleware - An existing ASP.NET Core application (or create a new one) ```bash dotnet new webapp -n SecureApp cd SecureApp ``` --- ## Understanding Security Headers Before implementing anything, let's understand what we're adding and why. ### Essential Security Headers | Header | Purpose | Protects Against | |--------|---------|------------------| | `Content-Security-Policy` | Controls which resources can load | XSS, data injection, clickjacking | | `X-Frame-Options` | Controls framing | Clickjacking | | `X-Content-Type-Options` | Prevents MIME sniffing | MIME confusion attacks | | `Referrer-Policy` | Controls referrer information | Data leakage | | `Strict-Transport-Security` | Enforces HTTPS | Protocol downgrade, MITM | | `Permissions-Policy` | Disables browser features | Feature abuse | ### Advanced Headers | Header | Purpose | |--------|---------| | `Cross-Origin-Opener-Policy` | Isolates browsing context | | `Cross-Origin-Embedder-Policy` | Controls resource embedding | | `Cross-Origin-Resource-Policy` | Controls cross-origin resource access | --- ## Manual Implementation Let's implement security headers manually to understand exactly what's happening. ### Basic Middleware Approach Create a middleware that adds security headers to every response: ```csharp // Middleware/SecurityHeadersMiddleware.cs public class SecurityHeadersMiddleware { private readonly RequestDelegate _next; public SecurityHeadersMiddleware(RequestDelegate next) { _next = next; } public async Task InvokeAsync(HttpContext context) { var headers = context.Response.Headers; // Prevent MIME type sniffing headers["X-Content-Type-Options"] = "nosniff"; // Prevent clickjacking headers["X-Frame-Options"] = "DENY"; // Control referrer information headers["Referrer-Policy"] = "strict-origin-when-cross-origin"; // Enforce HTTPS (only on HTTPS connections) if (context.Request.IsHttps) { headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"; } await _next(context); } } // Extension method for clean registration public static class SecurityHeadersMiddlewareExtensions { public static IApplicationBuilder UseSecurityHeaders(this IApplicationBuilder app) { return app.UseMiddleware(); } } ``` Register in `Program.cs`: ```csharp var app = builder.Build(); app.UseSecurityHeaders(); // Add early in pipeline app.UseHttpsRedirection(); app.UseStaticFiles(); app.UseRouting(); app.UseAuthorization(); app.MapRazorPages(); app.Run(); ``` ### Adding Content Security Policy CSP is more complex because it varies significantly by application. Let's add it to our middleware: ```csharp public async Task InvokeAsync(HttpContext context) { var headers = context.Response.Headers; // ... other headers ... // Content Security Policy var csp = new StringBuilder(); csp.Append("default-src 'self'; "); csp.Append("script-src 'self'; "); csp.Append("style-src 'self'; "); csp.Append("img-src 'self' data:; "); csp.Append("font-src 'self'; "); csp.Append("connect-src 'self'; "); csp.Append("frame-src 'none'; "); csp.Append("frame-ancestors 'none'; "); csp.Append("form-action 'self'; "); csp.Append("base-uri 'self'; "); csp.Append("object-src 'none'; "); csp.Append("upgrade-insecure-requests;"); headers["Content-Security-Policy"] = csp.ToString(); await _next(context); } ``` ### Adding Permissions-Policy Disable browser features you don't use: ```csharp // Permissions Policy - disable dangerous features headers["Permissions-Policy"] = "camera=(), " + "microphone=(), " + "geolocation=(), " + "payment=(), " + "usb=(), " + "magnetometer=(), " + "gyroscope=(), " + "accelerometer=()"; ``` ### Adding Cross-Origin Headers For additional isolation: ```csharp // Cross-Origin policies headers["Cross-Origin-Opener-Policy"] = "same-origin"; headers["Cross-Origin-Resource-Policy"] = "same-origin"; ``` ### Complete Manual Implementation Here's the complete middleware with all headers: ```csharp public class SecurityHeadersMiddleware { private readonly RequestDelegate _next; private readonly IWebHostEnvironment _env; public SecurityHeadersMiddleware(RequestDelegate next, IWebHostEnvironment env) { _next = next; _env = env; } public async Task InvokeAsync(HttpContext context) { var headers = context.Response.Headers; // Basic security headers headers["X-Content-Type-Options"] = "nosniff"; headers["X-Frame-Options"] = "DENY"; headers["Referrer-Policy"] = "strict-origin-when-cross-origin"; // HSTS (HTTPS only) if (context.Request.IsHttps) { headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"; } // Content Security Policy headers["Content-Security-Policy"] = BuildCsp(); // Permissions Policy headers["Permissions-Policy"] = BuildPermissionsPolicy(); // Cross-Origin policies headers["Cross-Origin-Opener-Policy"] = "same-origin"; headers["Cross-Origin-Resource-Policy"] = "same-origin"; // Remove identifying headers headers.Remove("Server"); headers.Remove("X-Powered-By"); await _next(context); } private string BuildCsp() { var csp = new StringBuilder(); if (_env.IsDevelopment()) { // Relaxed CSP for development (hot reload, etc.) csp.Append("default-src 'self' ws: wss:; "); csp.Append("script-src 'self' 'unsafe-inline'; "); csp.Append("style-src 'self' 'unsafe-inline'; "); csp.Append("img-src 'self' data: https:; "); csp.Append("font-src 'self'; "); csp.Append("connect-src 'self' ws: wss: http://localhost:*; "); csp.Append("frame-src 'none'; "); csp.Append("frame-ancestors 'none'; "); csp.Append("form-action 'self'; "); csp.Append("base-uri 'self'; "); csp.Append("object-src 'none';"); } else { // Strict CSP for production csp.Append("default-src 'self'; "); csp.Append("script-src 'self'; "); csp.Append("style-src 'self'; "); csp.Append("img-src 'self' data:; "); csp.Append("font-src 'self'; "); csp.Append("connect-src 'self'; "); csp.Append("frame-src 'none'; "); csp.Append("frame-ancestors 'none'; "); csp.Append("form-action 'self'; "); csp.Append("base-uri 'self'; "); csp.Append("object-src 'none'; "); csp.Append("upgrade-insecure-requests;"); } return csp.ToString(); } private string BuildPermissionsPolicy() { return "camera=(), microphone=(), geolocation=(), payment=(), " + "usb=(), magnetometer=(), gyroscope=(), accelerometer=()"; } } ``` --- ## Content Security Policy Deep Dive CSP is the most powerful and complex security header. Let's break down each directive. ### CSP Directives Explained #### Fetch Directives Control where resources can be loaded from: | Directive | Controls | Example | |-----------|----------|---------| | `default-src` | Fallback for other directives | `'self'` | | `script-src` | JavaScript sources | `'self' https://cdn.example.com` | | `style-src` | CSS sources | `'self' 'unsafe-inline'` | | `img-src` | Image sources | `'self' data: https:` | | `font-src` | Font sources | `'self' https://fonts.gstatic.com` | | `connect-src` | XHR, WebSocket, fetch | `'self' https://api.example.com` | | `media-src` | Audio/video sources | `'self'` | | `frame-src` | iframe sources | `'none'` or `https://youtube.com` | | `worker-src` | Web Worker sources | `'self'` | | `manifest-src` | Web manifest sources | `'self'` | #### Document Directives Control document behaviour: | Directive | Purpose | Recommended | |-----------|---------|-------------| | `base-uri` | Restricts `` element | `'self'` or `'none'` | | `form-action` | Restricts form submission targets | `'self'` | | `frame-ancestors` | Controls who can frame this page | `'none'` | #### Special Values | Value | Meaning | |-------|---------| | `'self'` | Same origin only | | `'none'` | Block all | | `'unsafe-inline'` | Allow inline scripts/styles (weakens security) | | `'unsafe-eval'` | Allow eval() (weakens security significantly) | | `data:` | Allow data: URIs | | `blob:` | Allow blob: URIs | | `https:` | Allow any HTTPS source | ### Building a Production CSP Start strict, then add exceptions as needed: ```csharp private string BuildProductionCsp() { var directives = new Dictionary> { ["default-src"] = new() { "'self'" }, ["script-src"] = new() { "'self'" }, ["style-src"] = new() { "'self'" }, ["img-src"] = new() { "'self'", "data:" }, ["font-src"] = new() { "'self'" }, ["connect-src"] = new() { "'self'" }, ["frame-src"] = new() { "'none'" }, ["frame-ancestors"] = new() { "'none'" }, ["form-action"] = new() { "'self'" }, ["base-uri"] = new() { "'self'" }, ["object-src"] = new() { "'none'" } }; // Add third-party sources as needed // directives["script-src"].Add("https://cdn.example.com"); // directives["style-src"].Add("https://fonts.googleapis.com"); // directives["font-src"].Add("https://fonts.gstatic.com"); var csp = directives .Select(d => $"{d.Key} {string.Join(" ", d.Value)}") .ToList(); csp.Add("upgrade-insecure-requests"); return string.Join("; ", csp); } ``` ### Common CSP Configurations #### Google Fonts ```csharp ["style-src"] = new() { "'self'", "https://fonts.googleapis.com" }, ["font-src"] = new() { "'self'", "https://fonts.gstatic.com" }, ``` #### YouTube Embeds ```csharp ["frame-src"] = new() { "https://www.youtube.com", "https://www.youtube-nocookie.com" }, ``` #### Google Analytics ```csharp ["script-src"] = new() { "'self'", "https://www.googletagmanager.com", "https://www.google-analytics.com" }, ["connect-src"] = new() { "'self'", "https://www.google-analytics.com", "https://analytics.google.com" }, ["img-src"] = new() { "'self'", "data:", "https://www.google-analytics.com" }, ``` #### External CDN ```csharp ["script-src"] = new() { "'self'", "https://cdn.jsdelivr.net", "https://cdnjs.cloudflare.com" }, ["style-src"] = new() { "'self'", "https://cdn.jsdelivr.net", "https://cdnjs.cloudflare.com" }, ``` ### CSP Reporting Before enforcing a strict CSP, use Report-Only mode to identify issues: ```csharp // Report-Only mode - doesn't block, just reports headers["Content-Security-Policy-Report-Only"] = csp + "; report-uri /api/csp-report"; ``` Create an endpoint to receive reports: ```csharp [ApiController] [Route("api/[controller]")] public class CspReportController : ControllerBase { private readonly ILogger _logger; public CspReportController(ILogger logger) { _logger = logger; } [HttpPost] public IActionResult Report([FromBody] CspReportRequest request) { _logger.LogWarning( "CSP Violation: {DocumentUri} blocked {BlockedUri} for {ViolatedDirective}", request.CspReport?.DocumentUri, request.CspReport?.BlockedUri, request.CspReport?.ViolatedDirective); return Ok(); } } public class CspReportRequest { [JsonPropertyName("csp-report")] public CspReport? CspReport { get; set; } } public class CspReport { [JsonPropertyName("document-uri")] public string? DocumentUri { get; set; } [JsonPropertyName("blocked-uri")] public string? BlockedUri { get; set; } [JsonPropertyName("violated-directive")] public string? ViolatedDirective { get; set; } [JsonPropertyName("effective-directive")] public string? EffectiveDirective { get; set; } [JsonPropertyName("original-policy")] public string? OriginalPolicy { get; set; } } ``` --- ## Environment-Aware Configuration Development needs different settings than production. Here's how to handle both cleanly. ### Using appsettings.json Define CSP sources in configuration: ```json // appsettings.json { "SecurityHeaders": { "Csp": { "ScriptSources": ["'self'"], "StyleSources": ["'self'", "https://fonts.googleapis.com"], "FontSources": ["'self'", "https://fonts.gstatic.com"], "ImageSources": ["'self'", "data:", "https:"], "ConnectSources": ["'self'"], "FrameSources": ["https://www.youtube.com"] }, "Hsts": { "MaxAge": 31536000, "IncludeSubDomains": true } } } // appsettings.Development.json { "SecurityHeaders": { "Csp": { "ScriptSources": ["'self'", "'unsafe-inline'"], "StyleSources": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"], "ConnectSources": ["'self'", "ws:", "wss:", "http://localhost:*"] } } } ``` ### Configuration-Based Middleware ```csharp public class SecurityHeadersOptions { public CspOptions Csp { get; set; } = new(); public HstsOptions Hsts { get; set; } = new(); } public class CspOptions { public List ScriptSources { get; set; } = new() { "'self'" }; public List StyleSources { get; set; } = new() { "'self'" }; public List FontSources { get; set; } = new() { "'self'" }; public List ImageSources { get; set; } = new() { "'self'", "data:" }; public List ConnectSources { get; set; } = new() { "'self'" }; public List FrameSources { get; set; } = new() { "'none'" }; } public class HstsOptions { public int MaxAge { get; set; } = 31536000; public bool IncludeSubDomains { get; set; } = true; } ``` Register with dependency injection: ```csharp // Program.cs builder.Services.Configure( builder.Configuration.GetSection("SecurityHeaders")); ``` --- ## Using SecurityMiddleware Library The manual approach works, but becomes unwieldy as requirements grow. The SecurityMiddleware library provides secure defaults with a clean, fluent API. ### Installation Add the SecurityMiddleware files to your project: ``` /SecurityMiddleware ├── SecurityOptions.cs ├── SecurityHeadersMiddleware.cs ├── SecurityExtensions.cs └── SecurityPresets.cs ``` Add the namespace: ```csharp using SecurityMiddleware; ``` ### Basic Usage ```csharp var app = builder.Build(); // Secure defaults - that's it app.UseSecurity(); app.UseHttpsRedirection(); app.UseStaticFiles(); // ... rest of pipeline ``` This single line gives you: - Strict Content Security Policy - X-Frame-Options: DENY - X-Content-Type-Options: nosniff - Referrer-Policy: strict-origin-when-cross-origin - HSTS with 1 year max-age - Restrictive Permissions-Policy - Cross-Origin isolation headers - Server header removal ### Custom Configuration ```csharp app.UseSecurity(options => { // Add Google Fonts options.ContentSecurityPolicy .AllowStyles("https://fonts.googleapis.com") .AllowFonts("https://fonts.gstatic.com"); // Add YouTube embeds options.ContentSecurityPolicy .AllowFrames("https://www.youtube.com", "https://www.youtube-nocookie.com"); // Allow inline styles (common requirement) options.ContentSecurityPolicy.AllowInlineStyles(); // Add external CDN options.ContentSecurityPolicy .AllowScripts("https://cdn.example.com"); }); ``` ### Environment-Aware Configuration The library automatically detects development mode: ```csharp // Automatically relaxes CSP for development app.UseSecurity(options => { options.ContentSecurityPolicy .AllowFrames("https://youtube.com"); }); ``` Or explicitly pass the environment: ```csharp app.UseSecurity(app.Environment, options => { options.ContentSecurityPolicy .AllowFrames("https://youtube.com"); }); ``` ### Using Presets Pre-configured settings for common scenarios: ```csharp // Maximum security (banking, healthcare) app.UseSecurity(options => options.ApplyPreset(SecurityPresets.Strict)); // REST APIs app.UseSecurity(options => options.ApplyPreset(SecurityPresets.Api)); // Single Page Applications app.UseSecurity(options => options.ApplyPreset(SecurityPresets.SinglePageApp)); // Marketing sites with analytics and embeds app.UseSecurity(options => options.ApplyPreset(SecurityPresets.Marketing)); // Legacy applications being migrated app.UseSecurity(options => options.ApplyPreset(SecurityPresets.Legacy)); ``` ### Combining Presets with Custom Config ```csharp app.UseSecurity(options => { // Start with marketing preset options.ApplyPreset(SecurityPresets.Marketing); // Add custom CDN options.ContentSecurityPolicy.AllowScripts("https://my-cdn.com"); // Enable HSTS preload options.Hsts.Preload = true; // Allow geolocation for store locator options.PermissionsPolicy.AllowSelf("geolocation"); }); ``` ### Full API Reference #### CSP Methods ```csharp options.ContentSecurityPolicy .AllowScripts("https://...") // script-src .AllowStyles("https://...") // style-src .AllowImages("https://...", "data:") // img-src .AllowFonts("https://...") // font-src .AllowConnections("https://...") // connect-src .AllowFrames("https://...") // frame-src .AllowFrameAncestors("https://...") // frame-ancestors .AllowFormAction("https://...") // form-action .AllowMedia("https://...") // media-src .AllowWorkers("https://...") // worker-src .AllowManifest("https://...") // manifest-src .AllowInlineScripts() // 'unsafe-inline' for scripts .AllowInlineStyles() // 'unsafe-inline' for styles .AllowEval() // 'unsafe-eval' .AllowDataUri("img-src", "font-src") // data: for directives .AllowBlobUri("worker-src") // blob: for directives .SetDirective("directive", "values") // Custom directive .AddToDirective("directive", "value") // Add to existing .RemoveDirective("directive"); // Remove directive ``` #### Other Headers ```csharp options.FrameOptions = FrameOptions.Deny; // or SameOrigin options.ReferrerPolicy = ReferrerPolicy.StrictOriginWhenCrossOrigin; options.Hsts.MaxAge = 63072000; // 2 years options.Hsts.IncludeSubDomains = true; options.Hsts.Preload = true; options.CrossOriginOpenerPolicy = CrossOriginOpenerPolicy.SameOrigin; options.CrossOriginEmbedderPolicy = CrossOriginEmbedderPolicy.RequireCorp; options.CrossOriginResourcePolicy = CrossOriginResourcePolicy.SameOrigin; options.RemoveServerHeader = true; options.RemovePoweredByHeader = true; ``` #### Permissions Policy ```csharp options.PermissionsPolicy .Disable("geolocation") // Disable entirely .AllowSelf("camera") // Same origin only .AllowAll("fullscreen") // All origins .Allow("microphone", "https://...") // Specific origins .Remove("accelerometer"); // Remove from policy ``` --- ## Testing Your Configuration ### Online Tools **SecurityHeaders.com** Visit https://securityheaders.com and enter your URL. Aim for an A+ grade. **Mozilla Observatory** Visit https://observatory.mozilla.org for a comprehensive security analysis. **CSP Evaluator** Visit https://csp-evaluator.withgoogle.com to validate your CSP specifically. ### Automated Testing Add security header tests to your test suite: ```csharp public class SecurityHeadersTests : IClassFixture> { private readonly HttpClient _client; public SecurityHeadersTests(WebApplicationFactory factory) { _client = factory.CreateClient(); } [Fact] public async Task Response_Should_Have_XContentTypeOptions() { var response = await _client.GetAsync("/"); Assert.True(response.Headers.Contains("X-Content-Type-Options")); Assert.Equal("nosniff", response.Headers.GetValues("X-Content-Type-Options").First()); } [Fact] public async Task Response_Should_Have_XFrameOptions() { var response = await _client.GetAsync("/"); Assert.True(response.Headers.Contains("X-Frame-Options")); Assert.Equal("DENY", response.Headers.GetValues("X-Frame-Options").First()); } [Fact] public async Task Response_Should_Have_ContentSecurityPolicy() { var response = await _client.GetAsync("/"); Assert.True(response.Headers.Contains("Content-Security-Policy")); var csp = response.Headers.GetValues("Content-Security-Policy").First(); Assert.Contains("default-src", csp); Assert.Contains("frame-ancestors 'none'", csp); } [Fact] public async Task Response_Should_Have_StrictTransportSecurity() { var response = await _client.GetAsync("/"); Assert.True(response.Headers.Contains("Strict-Transport-Security")); var hsts = response.Headers.GetValues("Strict-Transport-Security").First(); Assert.Contains("max-age=", hsts); } [Fact] public async Task Response_Should_Not_Have_Server_Header() { var response = await _client.GetAsync("/"); Assert.False(response.Headers.Contains("Server")); } } ``` ### Browser DevTools 1. Open DevTools (F12) 2. Go to Network tab 3. Select any request 4. Check Response Headers section 5. Verify all security headers are present --- ## Common Scenarios and Solutions ### Scenario: Using a JavaScript Framework (React, Vue, Angular) These often require inline styles and scripts during development: ```csharp app.UseSecurity(options => { options.ContentSecurityPolicy .AllowInlineStyles() // Often needed for CSS-in-JS .AllowConnections("https://api.yoursite.com"); // For production, consider using nonces instead of unsafe-inline }); ``` ### Scenario: E-commerce with Payment Providers ```csharp app.UseSecurity(options => { options.ContentSecurityPolicy .AllowScripts("https://js.stripe.com") .AllowFrames("https://js.stripe.com", "https://hooks.stripe.com") .AllowConnections("https://api.stripe.com"); // Enable payment feature for Stripe options.PermissionsPolicy.Allow("payment", "https://js.stripe.com"); }); ``` ### Scenario: Video Platform Integration ```csharp app.UseSecurity(options => { options.ContentSecurityPolicy .AllowFrames( "https://www.youtube.com", "https://www.youtube-nocookie.com", "https://player.vimeo.com" ); }); ``` ### Scenario: Analytics and Marketing ```csharp app.UseSecurity(options => { options.ApplyPreset(SecurityPresets.Marketing); // Add additional analytics providers options.ContentSecurityPolicy .AllowScripts("https://www.clarity.ms") .AllowConnections("https://www.clarity.ms"); }); ``` ### Scenario: API-Only Application ```csharp app.UseSecurity(options => { options.ApplyPreset(SecurityPresets.Api); // APIs don't need CSP for HTML, but keep other headers options.ContentSecurityPolicy.Enabled = false; }); ``` ### Scenario: Allowing Specific Sites to Frame Your Content ```csharp app.UseSecurity(options => { // Allow partner sites to embed your content options.ContentSecurityPolicy .AllowFrameAncestors("https://partner1.com", "https://partner2.com"); // Also update X-Frame-Options for older browsers options.FrameOptions = FrameOptions.SameOrigin; }); ``` --- ## Troubleshooting ### "Refused to execute inline script" **Cause**: CSP blocks inline scripts by default. **Solutions**: 1. Move inline scripts to external files (recommended) 2. Add `'unsafe-inline'` to script-src (not recommended) 3. Use nonces or hashes (advanced) ```csharp options.ContentSecurityPolicy.AllowInlineScripts(); // Quick fix ``` ### "Refused to load the stylesheet" **Cause**: External stylesheet not in style-src whitelist. **Solution**: Add the stylesheet source: ```csharp options.ContentSecurityPolicy.AllowStyles("https://fonts.googleapis.com"); ``` ### "Refused to connect to" **Cause**: API endpoint not in connect-src whitelist. **Solution**: Add the API endpoint: ```csharp options.ContentSecurityPolicy.AllowConnections("https://api.yoursite.com"); ``` ### "Refused to frame" **Cause**: iframe source not in frame-src whitelist. **Solution**: Add the frame source: ```csharp options.ContentSecurityPolicy.AllowFrames("https://www.youtube.com"); ``` ### Hot Reload Not Working in Development **Cause**: CSP blocking WebSocket connections for hot reload. **Solution**: The library handles this automatically. If using manual configuration: ```csharp if (app.Environment.IsDevelopment()) { options.ContentSecurityPolicy.AllowConnections("ws:", "wss:", "http://localhost:*"); } ``` ### HSTS Causing Issues in Development **Cause**: HSTS is remembered by browsers and can cause issues with localhost. **Solution**: HSTS is only applied on HTTPS connections. The library automatically handles this. If you've cached HSTS for localhost, clear it in browser settings. --- ## Summary Security headers are essential for protecting your users, and ASP.NET Core doesn't include them by default. You have two paths forward: **Manual Implementation** - Full control over every header - More code to maintain - Good for learning and simple applications **SecurityMiddleware Library** - Secure defaults out of the box - Clean, fluent API - Environment-aware configuration - Presets for common scenarios - Easy to extend and customise Whichever approach you choose, the important thing is to implement security headers. Your users are counting on you to protect them from attacks that these headers prevent. Start with `app.UseSecurity()` and adjust from there. Test with SecurityHeaders.com. Aim for that A+ grade. Your application's security is in your hands. Make it count. --- ## Resources - [SecurityMiddleware Library on GitHub](#) - The library used in this guide - [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) - [MDN Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) - [SecurityHeaders.com](https://securityheaders.com/) - Test your headers - [CSP Evaluator](https://csp-evaluator.withgoogle.com/) - Validate your CSP

Your Cart

Setting up security in .NET

Guide Details