Net Core security - NWebSec to the rescue!
Tags: webdev, security, aspnetcore, dotnet
Published: 2018-11-30 15:18:39

---
title: Net Core security - NWebSec to the rescue!
cover_image: https://thepracticaldev.s3.amazonaws.com/i/74ke75l2f6gfumhz7wsz.jpeg
published: true
description: Best practise and wee gotchas for securing net core apps
tags: webdev, security, aspnetcore, dotnet
---


A quick overview of securing a Net Core webapp using <a href="https://docs.nwebsec.com/en/latest/" target="_blank">NWebSec</a> and the web.config


First up, let's install NWebSec middleware from nuget via the package manager

```powershell
PM> Install-Package NWebsec.AspNetCore.Middleware
```

For those of you (like me) who are a little rusty on security best practise, two of the general principles are:
<ol>
<li>Reduce attack surface (make it as hard as possible for potential attackers to glean information about your app)</li>
<li>Restrict access (unless securely authorised)</li>
</ol>

The ingredients for a safe Net Core app broadly feed into these practises and include the following (non-exhaustive) list:
<ul>
<li>[HSTS] HTTP Strict Transport Security Header</li>
<li>X-XSS-Protection Header</li>
<li>X-Frame-Options Header</li>
<li>[CSP] Content-Security-Policy Header</li>
<li>X-Content-Type-Options Header</li>
<li>Referrer-Policy Http Header</li>
<li>Remove the X-Powered-By header to remove the additional information transferred by verifying the app tech</li>
<li>[HPKP] HTTP Public Key Pinning Header</li>
</ul>


Let's take these one at a time!

<h4 id="hsts">[HSTS] HTTP Strict Transport Security Header</h4>

This is what it sounds like - force all comms to go through HTTPS! Using the `.Preload()` indicated below forces it from the first request.


```csharp
app.UseHsts(options => options.MaxAge(365).IncludeSubdomains().Preload());
```

<h4 id="xxss">X-XSS-Protection Header</h4>

This response header prevents pages from loading in modern browsers when reflected cross-site scription is detected. This is often unnecessary if a site implements a strong `Content-Security-Policy` (spoilers!)

```csharp
app.UseXXssProtection(options => options.EnabledWithBlockMode());
```
<h4 id="xframoptions">X-Frame-Options Header</h4>

Ensure that site content is not being embedded in an iframe on other sites - used to avoid clickjacking attacks.

```csharp
app.UseXfo(options => options.SameOrigin());
```

<h4 id="csp">[CSP] Content-Security-Policy Header</h4>

The content security policy essentially allows you to whitelist resource origins when the site is loaded. These policies are usually to do with server and script origins.

There are a heap of different ways you can configure this and they are very much dependent upon your requirements and what you need to load in and out. You can read more about your options [in the handy Mozilla docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)

An example would be:

```csharp
app.UseCsp(opts => opts
    .BlockAllMixedContent()
    .StyleSources(s => s.Self())
    .StyleSources(s => s.UnsafeInline())
    .FontSources(s => s.Self())
    .FormActions(s => s.Self())
    .FrameAncestors(s => s.Self())
    .ImageSources(s => s.Self())
    .ScriptSources(s => s.Self())
);
```

<h4 id="xcontenttypeoptions">X-Content-Type-Options Header</h4>

Blocks any content sniffing that could happen that might change an innocent MIME type (e.g. text/css) into something executable that could do some real damage.

```csharp
app.UseXContentTypeOptions();
```

<h4 id="referrerpolicy">Referrer-Policy Http Header</h4>

This tells the site how much information to send along in the `Referer` header field (misspelt!). Default value is `no-referrer-when-downgrade` i.e. don't send any referrer data is we're downgrading security protocols and going HTTPS to an HTTP site.


This one depends a bit on your requirements, the options are listed in detail [on Mozilla's dev site](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) to help you make a decision. If you want to be super safe, then opt for:

```csharp
app.UseReferrerPolicy(opts => opts.NoReferrer());
```

<h4 id="xpoweredby">Remove X-Powered-By Header</h4>

Now let's make sure that we're not giving information away regarding the technology in use (i.e. ASP.NET). To do this, we'll remove the X-Powered-By header by adding to the web.config


```xml
<system.web>
   <httpRuntime enableVersionHeader="false"/>
</system.web>
<system.webServer>
   ...
   <httpProtocol>
     <customHeaders>
        <remove name="X-Powered-By" />
     </customHeaders>
   </httpProtocol>
</system.webServer>

```

<h4 id="hpkp">[HPKP] HTTP Public Key Pinning Header</h4>

This one is interesting and to do with the whitelisting certificates. There are couple of plugins you can use to facilitate this and it's covered comprehensively in @JoonasWestlin blog <a href="https://joonasw.net/view/hpkp-in-aspnet-core">here</a>

-----

<b>Further links/reading:</b> A good tool to test the security headers is using <a href="https://tools.geekflare.com/header-security-test" target="_blank">Geek Flare</a> and a wealth of easy to digest information for general .NET security best practise is available at [OWASP.org](https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet)

This is just a quick point of reference to get started on Net Core site (mostly header-based) security - what's missing? Other recommendations?