HTTPS and Security Headers

Enforcing HTTPS

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseHttpsRedirection(); // Redirect HTTP to HTTPS
    app.UseHsts();              // HTTP Strict Transport Security
}

HSTS (HTTP Strict Transport Security)

HSTS tells browsers to only use HTTPS for your site.

builder.Services.AddHsts(options =>
{
    options.MaxAge = TimeSpan.FromDays(365);
    options.IncludeSubDomains = true;
    options.Preload = true;
});

Security Headers

1. X-Content-Type-Options

Prevents MIME type sniffing.

app.Use(async (context, next) =>
{
    context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
    await next();
});

2. X-Frame-Options

Prevents clickjacking by controlling iframe embedding.

context.Response.Headers.Add("X-Frame-Options", "DENY");
// or "SAMEORIGIN" to allow same-origin framing

3. X-XSS-Protection

Enables browser's XSS filter (legacy, CSP is better).

context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");

4. Referrer-Policy

Controls how much referrer information is sent.

context.Response.Headers.Add("Referrer-Policy", "strict-origin-when-cross-origin");

5. Content-Security-Policy (CSP)

Controls which resources can be loaded.

context.Response.Headers.Add(
    "Content-Security-Policy",
    "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'"
);

Complete Security Headers Middleware

app.Use(async (context, next) =>
{
    context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
    context.Response.Headers.Add("X-Frame-Options", "DENY");
    context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");
    context.Response.Headers.Add("Referrer-Policy", "strict-origin-when-cross-origin");
    context.Response.Headers.Add(
        "Content-Security-Policy",
        "default-src 'self'; script-src 'self'; style-src 'self'"
    );
    await next();
});

Best Practices

• Always use HTTPS: In production
• Enable HSTS: Force HTTPS
• Add security headers: Defense in depth
• Use CSP: Prevent XSS and injection
• Test headers: Use securityheaders.com

Key Takeaways

• UseHttpsRedirection(): Redirect to HTTPS
• UseHsts(): HTTP Strict Transport Security
• X-Content-Type-Options: Prevent MIME sniffing
• X-Frame-Options: Prevent clickjacking
• CSP: Control resource loading
• Security headers: Multiple layers of protection