web analytics
Sign In | Register
Welcome, Guest
1 2 3 4

Security Headers in ASP.NET

 Options
Previous Topic Next Topic
@2021-08-04 20:18:06

Permissions-Policy

The Permissions-Policy header (formerly known as Feature-Policy), is a recent addition to the range of security-related headers. When specifying the header, you tell the browser which features your site uses or not. This is a great feature, especially if you embed other websites. To add the header, make the following change in web.config:

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Permissions-Policy" value="accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

Here, we tell the browser that our site shouldn't allow use of the accelerometer, camera, and more. Which features you need to add, totally depend on your site. For more information, check out the specification.
@2021-08-04 20:26:01

X-AspNet-Version

The HTTP X-AspNet-Version response header is used by Visual Studio to determine which version of ASP.NET is in use. It is not necessary for production sites and should be disabled. In the httpRuntime section of the web.config, set:

<httpRuntime enableVersionHeader="false" />
@2021-08-04 20:27:31

Server

ASP.NET also reveals the server hosting the application. If a hacker know that you are using IIS, this narrows the number of weaknesses that he/she needs to try. To remove the Server header, remove it from code in either a filter or through Global.asax.cs:

protected void Application_BeginRequest(object sender, EventArgs e)

{
 var app = sender as HttpApplication;
 if (app != null && app.Context != null) {
   app.Context.Response.Headers.Remove("Server");
 }
}

or 

protected void Application_PreSendRequestHeaders()
{
    if (HttpContext.Current != null)
    {
        HttpContext.Current.Response.Headers.Remove("Server");
    }
}
@2021-08-04 20:36:31

X-AspNetMvc-Version 

Open the Global.asax.cs file, find the event Application_Start event and add the following line at the end of the code.

protected void Application_Start()
{
    //some code
    MvcHandler.DisableMvcResponseHeader = true; //this line is to hide mvc header
}
Previous Topic Next Topic
1 2 3 4

Comments
You must Sign In to comment on this topic.


© 2024 Digcode.com