Set minimum security headers for all requests (#527)

DFE-Digital · Jul 3, 2024 · ee757a6 · ee757a6
1 parent 6a62cac
commit ee757a6
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 0 deletions.
diff --git a/TramsDataApi/Startup.cs b/TramsDataApi/Startup.cs
@@ -116,6 +116,35 @@ public void ConfigureServices(IServiceCollection services)
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
         public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IApiVersionDescriptionProvider provider)
         {
+            app.UseSecurityHeaders(options =>
+            {
+                options.AddFrameOptionsDeny()
+                    .AddXssProtectionDisabled()
+                    .AddContentTypeOptionsNoSniff()
+                    .RemoveServerHeader()
+                    .AddContentSecurityPolicy(builder =>
+                    {
+                        builder.AddDefaultSrc().None();
+                    })
+                    .AddPermissionsPolicy(builder =>
+                    {
+                        builder.AddAccelerometer().None();
+                        builder.AddAutoplay().None();
+                        builder.AddCamera().None();
+                        builder.AddEncryptedMedia().None();
+                        builder.AddFullscreen().None();
+                        builder.AddGeolocation().None();
+                        builder.AddGyroscope().None();
+                        builder.AddMagnetometer().None();
+                        builder.AddMicrophone().None();
+                        builder.AddMidi().None();
+                        builder.AddPayment().None();
+                        builder.AddPictureInPicture().None();
+                        builder.AddSyncXHR().None();
+                        builder.AddUsb().None();
+                    });
+            });
+
             app.UseSwagger();
             app.UseSwaggerUI(c =>
             {

diff --git a/TramsDataApi/TramsDataApi.csproj b/TramsDataApi/TramsDataApi.csproj
@@ -34,6 +34,7 @@
         </PackageReference>
         <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.6" />
         <PackageReference Include="Microsoft.FeatureManagement.AspNetCore" Version="3.4.0" />
+        <PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders" Version="0.22.0" />
         <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
         <PackageReference Include="Serilog.Sinks.ApplicationInsights" Version="4.0.0" />
         <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />