DEV Community

Simon Foster
Simon Foster

Posted on • Edited on • Originally published at funkysi1701.com

1 2

Security Headers

Have you wondered what info you are leaking via your response headers?, do you want some kind of guide about what headers to set or remove altogether?

Head on over to https://securityheaders.com/ This is a site created by security expert Scott Helme that rates a URL based on what response headers it can see.

I am pleased to say www.funkysi1701.com is now getting an A.Alt Text

So how do you add/remove headers in dotnet core?

In my configure method in Startup.cs I have the following code block.

app.Use(
    next =>
    {
        return async context =>
        {
            context.Response.OnStarting(
                () =>
                {
                    context.Response.Headers.Add("Permissions-Policy", "microphone=()");     
                    context.Response.Headers.Remove("Server");
                    context.Response.Headers.Remove("X-Powered-By");
                    context.Response.Headers.Remove("X-AspNet-Version");
                    return Task.CompletedTask;
                });

             await next(context);
         };
     });
Enter fullscreen mode Exit fullscreen mode

I have only included a few of the headers I am adding as the excellent https://securityheaders.com/ can tell you which headers you should add and what options you might want.

Heroku

Simplify your DevOps and maximize your time.

Since 2007, Heroku has been the go-to platform for developers as it monitors uptime, performance, and infrastructure concerns, allowing you to focus on writing code.

Learn More

Top comments (0)

Sentry image

See why 4M developers consider Sentry, “not bad.”

Fixing code doesn’t have to be the worst part of your day. Learn how Sentry can help.

Learn more