If you like at the OWASP site, you’ll find a while list of common security-related HTTP headers that every web application should implement. These headers are an essential part of building a secure web application.
If you are too lazy to click on the link, here is the full list:
- Strict-Transport-Security
- X-Frame-Options, Frame-Options
- X-XSS-Protection
- X-Content-Type-Options
- Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP
- Content-Security-Policy-Report-Only
There are multiple ways to add these security headers to you application. You can configure IIS to include them, add some extra ASP.NET (MVC) configuration or you can build some OWIN middleware to add these headers to every HTTP request.
If you decide to use OWIN, be aware that most of the work is already done for you. On GitHub I found the SecurityHeadersMiddleware project which implements most of the headers mentioned above.
Get started
The easiest way to get started is to install the package using NuGet: Install-Package SecurityHeadersMiddleware
Inside your startup.cs class, you can now add some code to enable the headers:
More information can be found here.