NetEscapades.AspNetCore.SecurityHeaders

Changes in 1.3.0:

Features:

• Add API for registering an async policy selector #259 (Thanks @jchannon)
• Update Content-Security-Policy builders to encourage correct directives and to flag incorrect directives #272
• Add OverInsecureHttp() and OverInsecureWs() scheme sources to CSP builders #273

Changes in 1.2.0:

Features:

• Add support for child-src to Content-Security-Policy #259
• Allow multiple calls to AddSecurityHeadersPolicies() for registering named polices #250

Fixes:

• Fix typos in ReadMe #256 (Thanks @jt-pt-dev)

Changes in 1.1.0

Features:

• Add AddRange() to SourceCollection #240, #242 (Thanks @rankobp)
• Improve CSP documentation #241 (Thanks @Meir017)
• Add X-Frame-Options ALLOW-FROM with correct method name AddFrameOptionsAllowFrom() #244

Changes in 1.0.0

This marks the first major release of the NetEscapades.AspNetCore.SecurityHeaders. For simplicity, all the changes since 0.24.0 are included below.

Breaking Changes:

• Drop support for .NET Standard 2.0, raises minimum framework to .NET Core 3.1 #167, #171
• Removed "document header" functionality, in favour of always adding all headers #186
• Remove X-XSS-Protection from default headers and mark obsolete #168
• Add cross-origin-opener-policy: same-origin to default headers #184
• Mark Feature-Policy as obsolete #187
• Mark Expect-CT as obsolete #197
• Make nonce generation lazy on call to HttpContext.GetNonce() #198
• Remove ambient-light-sensor=() from DefaultSecureDirectives() for permissions policy #203 (Thanks damienbod!)
• Update COOP, COEP, and CORP for AddDefaultSecurityHeaders() and AddDefaultApiSecurityHeaders() #204 (Thanks damienbod!)
• Removes obsolete APIs (#217)

Features:

• Allow configuring "named" policies, and applying different policies to different endpoints #172, #173, #185
• Allow customizing the HeaderPolicyCollection just before it is applied, customizing per request #174, #185
• Make adding directives to Content-Security-Policy idempotent to avoid duplicates #169
• Add AddDefaultApiSecurityHeaders() for adding default headers to APIs #183, #184
• Add AddPermissionsPolicyWithRecommendedDirectives() and PermissionsPolicyBuilder.AddDefaultSecureDirectives() for adding secure Permissions-Policy directives in bulk #183, #184
• NetEscapades.AspNetCore.SecurityHeaders now has an icon, thanks @khalidabuhakmeh! #195
• Allow accessing an IServiceProvider when configuring a SecurityHeaderPolicyBuilder #200
• Adds support for Trusted Types to Content-Security-Policy (#216, #218)

Build updates:

• Allow building from forks #232

• Fix release generation #231, #235, #236

• Fix recording test results #221

• Define version in the build project instead #223

• Generate SBOM #222

• Generate SBOM attestation #224

• Generate artifact provenance attestation #225

• Automatically create releases #229

  See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v130 for more details.
  

Changes in 1.2.0:

Features:

• Add support for child-src to Content-Security-Policy #259
• Allow multiple calls to AddSecurityHeadersPolicies() for registering named polices #250

Fixes:

• Fix typos in ReadMe #256 (Thanks @jt-pt-dev)

Changes in 1.1.0

Features:

• Add AddRange() to SourceCollection #240, #242 (Thanks @rankobp)
• Improve CSP documentation #241 (Thanks @Meir017)
• Add X-Frame-Options ALLOW-FROM with correct method name AddFrameOptionsAllowFrom() #244

Changes in 1.0.0

This marks the first major release of the NetEscapades.AspNetCore.SecurityHeaders. For simplicity, all the changes since 0.24.0 are included below.

Breaking Changes:

• Drop support for .NET Standard 2.0, raises minimum framework to .NET Core 3.1 #167, #171
• Removed "document header" functionality, in favour of always adding all headers #186
• Remove X-XSS-Protection from default headers and mark obsolete #168
• Add cross-origin-opener-policy: same-origin to default headers #184
• Mark Feature-Policy as obsolete #187
• Mark Expect-CT as obsolete #197
• Make nonce generation lazy on call to HttpContext.GetNonce() #198
• Remove ambient-light-sensor=() from DefaultSecureDirectives() for permissions policy #203 (Thanks damienbod!)
• Update COOP, COEP, and CORP for AddDefaultSecurityHeaders() and AddDefaultApiSecurityHeaders() #204 (Thanks damienbod!)
• Removes obsolete APIs (#217)

Features:

• Allow configuring "named" policies, and applying different policies to different endpoints #172, #173, #185
• Allow customizing the HeaderPolicyCollection just before it is applied, customizing per request #174, #185
• Make adding directives to Content-Security-Policy idempotent to avoid duplicates #169
• Add AddDefaultApiSecurityHeaders() for adding default headers to APIs #183, #184
• Add AddPermissionsPolicyWithRecommendedDirectives() and PermissionsPolicyBuilder.AddDefaultSecureDirectives() for adding secure Permissions-Policy directives in bulk #183, #184
• NetEscapades.AspNetCore.SecurityHeaders now has an icon, thanks @khalidabuhakmeh! #195
• Allow accessing an IServiceProvider when configuring a SecurityHeaderPolicyBuilder #200
• Adds support for Trusted Types to Content-Security-Policy (#216, #218)

Build updates:

• Allow building from forks #232
• Fix release generation #231, #235, #236
• Fix recording test results #221
• Define version in the build project instead #223
• Generate SBOM #222
• Generate SBOM attestation #224
• Generate artifact provenance attestation #225
• Automatically create releases #229

Changes from 1.0.0-preview.4 to 1.0.0:

• Allow building from forks #232
• Fix release generation #231, #235, #236 See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v120 for more details.

Changes in 1.1.0

Features:

• Add AddRange() to SourceCollection #240, #242 (Thanks @rankobp)
• Improve CSP documentation #241 (Thanks @Meir017)
• Add X-Frame-Options ALLOW-FROM with correct method name AddFrameOptionsAllowFrom() #244

Changes in 1.0.0

This marks the first major release of the NetEscapades.AspNetCore.SecurityHeaders. For simplicity, all the changes since 0.24.0 are included below.

Breaking Changes:

• Drop support for .NET Standard 2.0, raises minimum framework to .NET Core 3.1 #167, #171
• Removed "document header" functionality, in favour of always adding all headers #186
• Remove X-XSS-Protection from default headers and mark obsolete #168
• Add cross-origin-opener-policy: same-origin to default headers #184
• Mark Feature-Policy as obsolete #187
• Mark Expect-CT as obsolete #197
• Make nonce generation lazy on call to HttpContext.GetNonce() #198
• Remove ambient-light-sensor=() from DefaultSecureDirectives() for permissions policy #203 (Thanks damienbod!)
• Update COOP, COEP, and CORP for AddDefaultSecurityHeaders() and AddDefaultApiSecurityHeaders() #204 (Thanks damienbod!)
• Removes obsolete APIs (#217)

Features:

• Allow configuring "named" policies, and applying different policies to different endpoints #172, #173, #185
• Allow customizing the HeaderPolicyCollection just before it is applied, customizing per request #174, #185
• Make adding directives to Content-Security-Policy idempotent to avoid duplicates #169
• Add AddDefaultApiSecurityHeaders() for adding default headers to APIs #183, #184
• Add AddPermissionsPolicyWithRecommendedDirectives() and PermissionsPolicyBuilder.AddDefaultSecureDirectives() for adding secure Permissions-Policy directives in bulk #183, #184
• NetEscapades.AspNetCore.SecurityHeaders now has an icon, thanks @khalidabuhakmeh! #195
• Allow accessing an IServiceProvider when configuring a SecurityHeaderPolicyBuilder #200
• Adds support for Trusted Types to Content-Security-Policy (#216, #218)

Build updates:

• Allow building from forks #232
• Fix release generation #231, #235, #236
• Fix recording test results #221
• Define version in the build project instead #223
• Generate SBOM #222
• Generate SBOM attestation #224
• Generate artifact provenance attestation #225
• Automatically create releases #229

Changes from 1.0.0-preview.4 to 1.0.0:

• Allow building from forks #232
• Fix release generation #231, #235, #236 See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v110 for more details.

Changes in 1.0.0

This marks the first major release of the NetEscapades.AspNetCore.SecurityHeaders. For simplicity, all the changes since 0.24.0 are included below.

Breaking Changes:

• Drop support for .NET Standard 2.0, raises minimum framework to .NET Core 3.1 #167, #171
• Removed "document header" functionality, in favour of always adding all headers #186
• Remove X-XSS-Protection from default headers and mark obsolete #168
• Add cross-origin-opener-policy: same-origin to default headers #184
• Mark Feature-Policy as obsolete #187
• Mark Expect-CT as obsolete #197
• Make nonce generation lazy on call to HttpContext.GetNonce() #198
• Remove ambient-light-sensor=() from DefaultSecureDirectives() for permissions policy #203 (Thanks damienbod!)
• Update COOP, COEP, and CORP for AddDefaultSecurityHeaders() and AddDefaultApiSecurityHeaders() #204 (Thanks damienbod!)
• Removes obsolete APIs (#217)

Features:

• Allow configuring "named" policies, and applying different policies to different endpoints #172, #173, #185
• Allow customizing the HeaderPolicyCollection just before it is applied, customizing per request #174, #185
• Make adding directives to Content-Security-Policy idempotent to avoid duplicates #169
• Add AddDefaultApiSecurityHeaders() for adding default headers to APIs #183, #184
• Add AddPermissionsPolicyWithRecommendedDirectives() and PermissionsPolicyBuilder.AddDefaultSecureDirectives() for adding secure Permissions-Policy directives in bulk #183, #184
• NetEscapades.AspNetCore.SecurityHeaders now has an icon, thanks @khalidabuhakmeh! #195
• Allow accessing an IServiceProvider when configuring a SecurityHeaderPolicyBuilder #200
• Adds support for Trusted Types to Content-Security-Policy (#216, #218)

Build updates:

• Allow building from forks #232
• Fix release generation #231, #235, #236
• Fix recording test results #221
• Define version in the build project instead #223
• Generate SBOM #222
• Generate SBOM attestation #224
• Generate artifact provenance attestation #225
• Automatically create releases #229

Changes from 1.0.0-preview.4 to 1.0.0:

• Allow building from forks #232
• Fix release generation #231, #235, #236 See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v100 for more details.

Features:

• Allow adding multiple uris to CSP builder AddFrameAncestors() #179
• Add support for additional directives on Permissions-Policy header #177 (Thanks @Registeel!)

See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v0240 for more details.

Features:

• Add support for unsafe-hashes on style attributes, and inline event handlers #162 (Thanks @tiesmaster!)

See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v0230 for more details.

Features:

• Add support for Cross-Origin-Embedder-Policy: credentialless #153 (Thanks RaceProUK!)

Bugfix:

• Fix documentation errors in StyleSourceAttr and StyleSourceElem directives #152 (Thanks ThomasBjallas!)

Features:

• Add support for using both 'none' and 'report-sample' in directives

See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v0210 for more details.

Features:

• Add support for script-src-attr, script-src-elem, style-src-attr, style-src-elem #139

See https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders/blob/master/CHANGELOG.md#v0200 for more details.

Features:

• Apply "document" headers to text/javascript responses

Features:

• Add support for applying document headers (such as CSP) to all responses (#130)
• Add support for unsafe-hashes and wasm-unsafe-eval (#125)
• Add support for Report-To directive in Content-Security-Policy (#126)
• Add support for sandbox directive in Content-Security-Policy (#127)
• Add support for Reporting-Endpoints header (part of the Reporting API) (#128)

Bugfix:

• Document headers (such as CSP) are now applied to application/javascript in addition to text/html (#130)

Bugfix:

• Fix Cross-Origin-Embedder-Policy (COEP) not being added to non-HTML requests

Bugfix:

• Fix Cross-Origin-Resource-Policy (CORP) not being added to non-HTML requests

Features:

• Added support for Cross-Origin-Opener-Policy (COOP), Cross-Origin-Embedder-Policy (COEP) and Cross-Origin-Resource-Policy (CORP) (Thanks @jeremylindsayni!)

Features:

• Add support for creating custom CSP directives with CspDirectiveBuilder. Enables creating custom directives (for example unsupported, draft, directives) that require nonce or hash values

BugFix:

• Add missing EncryptedMedia directive to permissions policy (Thanks @jotoledo)

Features:

• Add support for interest-cohort=() in Permissions-Policy directive (Thanks @jeremylindsayni!)

BugFix:

• Rename AddFrameSource() -> AddFrameSrc() for consistency, and deprecate AddFrameSource()

Features:

• Add support for report-sample in style-src directive for CSP (Thanks @jeremylindsayni!)

BugFix:

• Fix API inconsistencies between Permissions-Policy and Feature-Policy (Thanks @Rtalos!)

Features:

• Add support for manifest-src directive in CSP (Thanks @jotatoledo!)
• Add support for Permissions-Policy (supersedes Feature-Policy) (Thanks @Rtalos!)

Minor:

• Switch to standard MIT SPDX license

Features:

• Add support for Expect-CT header. Allows excluding domains that will not have the Expect-CT header applied. By default, the Expect-CT header will not be applied to localhost. It is also only applied to HTTPS requests
• Add support for worker-src directive for Content-Security-Policy header

Breaking Changes:

• Drop support for ASP.NET Core 1.x
• Add support for ASP.NET Core 3.0

Features:

• Add support for Nonce generation for Content-Security-Policy headers. See README.md for details
• Add TagHelpers library for adding nonces and generating hashes for Razor elements.
• Allow using HSTS preload with Strict-Transport-Security
• Allow excluding domains from Strict-Transport-Security. Similar to the Microsoft HstsMiddleware, you can skip applying Strict-Transport-Security to specific hosts

Breaking Changes:

• All obsolete classes have been removed.
• Many classes have changed namespace to better reflect their location in the project, and also to aid discovery. If you're using the recommended builders and extension methods, you should not have any build-time breaking changes, but the package is not runtime-compatible with previous versions
• The Strict-Transport-Security header is no longer applied to localhost by default. Generally speaking, this isn't something you should do anyway.
• The CSP classes have undergone significant refactoring to allow dynamic values per-request (i.e. nonces). This doesn't affect the main public API, but will impact you if you're working with the low-level infrastructure classes.