HSTS is an HTTP security policy that tells browsers to access a web server only over HTTPS, keeping connections on secure channels. section 12.1.4
Treat HSTS as a low-cost production security improvement: it needs little configuration, has negligible performance impact, and supports security assessments. section 12.1.4
Enable HSTS outside development
In the web API's Program.cs pipeline, keep development tooling in the development branch and call app.UseHsts() in the production branch. section 12.1.4
Listing 12.1 Program.cs file: HTTP security headers
if (app.Environment.IsDevelopment())
{
app.UseSwagger();
app.UseSwaggerUI();
}
else
{
// HTTP Security Headers
app.UseHsts(); #1
app.Use(async (context, next) =>
{
context.Response.Headers.Add("X-Frame-Options",
"sameorigin"); #2
context.Response.Headers.Add("X-XSS-Protection",
"1; mode=block"); #3
context.Response.Headers.Add("X-Content-Type-Options",
"nosniff"); #4
context.Response.Headers.Add("Content-Security-Policy",
"default-src ' self' ;"); #5
context.Response.Headers.Add("Referrer-Policy",
"strict-origin"); #6
await next();
});
}
Inspect the Program.cs listing alongside related security-header middleware. section 12.1.4
