Sidio.Web.Security
1.1.0
Prefix Reserved
See the version list below for details.
dotnet add package Sidio.Web.Security --version 1.1.0
NuGet\Install-Package Sidio.Web.Security -Version 1.1.0
<PackageReference Include="Sidio.Web.Security" Version="1.1.0" />
paket add Sidio.Web.Security --version 1.1.0
#r "nuget: Sidio.Web.Security, 1.1.0"
// Install Sidio.Web.Security as a Cake Addin #addin nuget:?package=Sidio.Web.Security&version=1.1.0 // Install Sidio.Web.Security as a Cake Tool #tool nuget:?package=Sidio.Web.Security&version=1.1.0
ASP.NET Core web security
Goal of this project
The goal of this project is to provide a set of services, helper functions and middleware that can be used to secure an ASP.NET Core application. All features are based on the Mozilla Web Security Guidelines.
Note:
The packages are currently in preview and is not yet ready for production use. During the preview phase, breaking changes may be introduced. Extensive documentation is also still being worked on.
Packages
Sidio.Web.Security.AspNetCore
Sidio.Web.Security.AspNetCore provides the ASP.NET Core services and middleware. The project targets .NET 8.0 and higher.
Sidio.Web.Security.Testing
Sidio.Web.Security.Testing provides testing functionality that can be used to verify that the security headers are set correctly.
.NET Framework support: Sidio.Web.Security
Sidio.Web.Security provides the core functionality. Can be used in projects targeting .NET Standard 2.0. It is useful to use this package if .NET Framework is still in use. Otherwise, use Sidio.Web.Security.AspNetCore. Note that this package does not contain the middleware and services that are provided by the ASP.NET Core package. Feel free to make a contribution to this project or a fork targeting .NET Framework.
Code quality
HTTP headers
- Content-Security-Policy: docs
- Referrer-Policy: docs
- Report-To: docs
- Strict-Transport-Security (HSTS): docs
- X-Content-Type-Options: docs
- X-Frame-Options: docs
Read more in the wiki docs.
Example
builder.Services
.AddContentSecurityPolicy();
app.UseXFrameOptions();
app.UseXContentTypeOptions();
app.UseStrictTransportSecurity();
app.UseContentSecurityPolicy(
(services, b) =>
{
b.AddDefaultSrc(x => x.AllowSelf());
b.AddScriptSrc(x => x.AddNonce(services).AllowUnsafeInline().AllowUrl("https://cdn.example.com"));
b.AddStyleSrc(x => x.AddNonce(services));
});
See getting started and the recommended ASP.NET Core configuration.
Reporting API
The reporting API can be used to report violations of the Content Security Policy. Read more in the wiki docs.
Default policies
Testing
The package Sidio.Web.Security.Testing provides a set of functions that can be used to test the security configuration of an ASP.Net Core application. Read more.
Contributions
Contributions are welcome! Feel free to create a pull request or an issue.
License
This project is licensed under the MIT License.
Texts used in this project (including this readme, the code documentation and wiki pages) may come from, or be based on, the MDN Web Doc's. Documentation by Mozilla Contributors is licensed under CC-BY-SA 2.5.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net5.0 was computed. net5.0-windows was computed. net6.0 was computed. net6.0-android was computed. net6.0-ios was computed. net6.0-maccatalyst was computed. net6.0-macos was computed. net6.0-tvos was computed. net6.0-windows was computed. net7.0 was computed. net7.0-android was computed. net7.0-ios was computed. net7.0-maccatalyst was computed. net7.0-macos was computed. net7.0-tvos was computed. net7.0-windows was computed. net8.0 is compatible. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. |
| .NET Core | netcoreapp2.0 was computed. netcoreapp2.1 was computed. netcoreapp2.2 was computed. netcoreapp3.0 was computed. netcoreapp3.1 was computed. |
| .NET Standard | netstandard2.0 is compatible. netstandard2.1 was computed. |
| .NET Framework | net461 was computed. net462 was computed. net463 was computed. net47 was computed. net471 was computed. net472 was computed. net48 was computed. net481 was computed. |
| MonoAndroid | monoandroid was computed. |
| MonoMac | monomac was computed. |
| MonoTouch | monotouch was computed. |
| Tizen | tizen40 was computed. tizen60 was computed. |
| Xamarin.iOS | xamarinios was computed. |
| Xamarin.Mac | xamarinmac was computed. |
| Xamarin.TVOS | xamarintvos was computed. |
| Xamarin.WatchOS | xamarinwatchos was computed. |
-
.NETStandard 2.0
- Microsoft.Extensions.Caching.Abstractions (>= 8.0.0)
- Microsoft.Extensions.Http (>= 8.0.0)
- Microsoft.Extensions.Logging.Abstractions (>= 8.0.1)
- Microsoft.Extensions.Options (>= 8.0.2)
- System.Text.Json (>= 8.0.4)
-
net8.0
- Microsoft.Extensions.Caching.Abstractions (>= 8.0.0)
- Microsoft.Extensions.Http (>= 8.0.0)
- Microsoft.Extensions.Logging.Abstractions (>= 8.0.1)
- Microsoft.Extensions.Options (>= 8.0.2)
- System.Text.Json (>= 8.0.4)
NuGet packages (2)
Showing the top 2 NuGet packages that depend on Sidio.Web.Security:
| Package | Downloads |
|---|---|
|
Sidio.Web.Security.AspNetCore
Sidio.Web.Security.AspNetCore provides services and middleware to secure ASP.NET Core applications. |
|
|
Sidio.Web.Security.Testing
Sidio.Web.Testing provides testing functionality that can be used to verify that the security headers are set correctly. |
GitHub repositories
This package is not used by any popular GitHub repositories.