You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
44 lines
1.8 KiB
44 lines
1.8 KiB
// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
|
|
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
|
|
|
|
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.AspNetCore.Mvc.Filters;
|
|
|
|
namespace IdentityServer4.Quickstart.UI
|
|
{
|
|
public class SecurityHeadersAttribute : ActionFilterAttribute
|
|
{
|
|
public override void OnResultExecuting(ResultExecutingContext context)
|
|
{
|
|
var result = context.Result;
|
|
if (result is ViewResult)
|
|
{
|
|
if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Type-Options"))
|
|
{
|
|
context.HttpContext.Response.Headers.Add("X-Content-Type-Options", "nosniff");
|
|
}
|
|
if (!context.HttpContext.Response.Headers.ContainsKey("X-Frame-Options"))
|
|
{
|
|
context.HttpContext.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
|
|
}
|
|
|
|
var csp = "default-src 'self';";
|
|
// an example if you need client images to be displayed from twitter
|
|
//var csp = "default-src 'self'; img-src 'self' https://pbs.twimg.com";
|
|
|
|
// once for standards compliant browsers
|
|
if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
|
|
{
|
|
context.HttpContext.Response.Headers.Add("Content-Security-Policy", csp);
|
|
}
|
|
// and once again for IE
|
|
if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Security-Policy"))
|
|
{
|
|
context.HttpContext.Response.Headers.Add("X-Content-Security-Policy", csp);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|