Improve security header - add x-frame-options / permissions-policy

grandnode · Oct 5, 2021 · 5ede858 · 5ede858
1 parent 910a249
commit 5ede858
Showing 1 changed file with 17 additions and 0 deletions.
diff --git a/src/Web/Grand.Web.Common/Infrastructure/ApplicationBuilderExtensions.cs b/src/Web/Grand.Web.Common/Infrastructure/ApplicationBuilderExtensions.cs
@@ -291,6 +291,7 @@ public static void UseDefaultSecurityHeaders(this IApplicationBuilder applicatio
         {
             var policyCollection = new HeaderPolicyCollection()
                 .AddXssProtectionBlock()
+                .AddFrameOptionsDeny()
                 .AddContentTypeOptionsNoSniff()
                 .AddStrictTransportSecurityMaxAgeIncludeSubDomains(maxAgeInSeconds: 60 * 60 * 24 * 365) // maxage = one year in seconds
                 .AddReferrerPolicyStrictOriginWhenCrossOrigin()
@@ -308,6 +309,22 @@ public static void UseDefaultSecurityHeaders(this IApplicationBuilder applicatio
                     builder.AddScriptSrc().From("*").UnsafeInline().UnsafeEval();
                     builder.AddStyleSrc().From("*").UnsafeEval().UnsafeInline();
                 })
+                .AddPermissionsPolicy(builder =>
+                {                    
+                    builder.AddAutoplay().Self();
+                    builder.AddCamera().None();
+                    builder.AddEncryptedMedia().Self();
+                    builder.AddFullscreen().All();
+                    builder.AddGeolocation().Self();
+                    builder.AddGyroscope().None();
+                    builder.AddMagnetometer().None();
+                    builder.AddMicrophone().None();
+                    builder.AddMidi().None();
+                    builder.AddPayment().None();
+                    builder.AddPictureInPicture().None();
+                    builder.AddSyncXHR().None();
+                    builder.AddUsb().None();
+                })
                 .RemoveServerHeader();
 
             application.UseSecurityHeaders(policyCollection);