How to remove the server header from ASP.NET Core 3.1

KarthikKannan — Sun, 03 May 2020 00:46:21 +0000

In this post, I will show how to remove the server header from ASP.NET Core 3.1. The fix is the same for other versions as well.

Are you looking for more security features from the below list to implement in the ASP.NET Core application?

content-security-policy
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: Deny
x-ua-compatible: IE=edge,chrome=1
x-xss-protection: 1; mode=block

Add required security code in the ASP.NET Core application to avoid exploitation by the hackers.

Let me walk you through the problem and the solution to it. Most of us create ASP.NET Core applications using the default template that is available from Visual Studio IDE. The created template does not have the security feature implemented by default.

You may create a brand new ASP.NET Core Web Application using the default template and run the default weatherforecast endpoint, you will see the below response.

Open the developers’ tool by pressing F12 on your keyboard.

Response header details for a given API endpoint

Response header has server details displayed which puts the web application gets exploited by the outside world.

Remove Server Header

The code shown below is in the “Program” class which is created by default.

using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Hosting;

namespace KarthikTechBlog.SecurityFeatures.API
{
    public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.UseStartup();
                });
    }
}

Fix is pretty small and easy. come, let’s fix it.

Code Fix

Add UseKestrel and specify AddServerHeader to false which is to make sure the server header is not sent in the API response.

webBuilder.UseKestrel((options) =>
                    {
                        // Do not add the Server HTTP header.
                        options.AddServerHeader = false;
                    });

Complete Code

using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Hosting;

namespace KarthikTechBlog.SecurityFeatures.API
{
    public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.UseStartup();
                    webBuilder.UseKestrel((options) =>
                    {
                        // Do not add the Server HTTP header.
                        options.AddServerHeader = false;
                    });
                });
    }
}

Server header information removed

Related Resources

Conclusion

In this post, I showed how to remove the server header from ASP.NET Core 3.1. That’s all from this post. If you have any questions or just want to chat with me, feel free to leave a comment below.

The post How to remove the server header from ASP.NET Core 3.1 appeared first on Learn Smart Coding.

How to apply various Security Feature in ASP.NET Core application

KarthikKannan — Sat, 02 May 2020 21:08:12 +0000

In this post, I will show How to apply various Security Feature in ASP.NET Core application.

In today’s world, the attacks against internet-exposed web apps are the top cause of data breaches that is why Web application security is crucial. There is various important security measure one should implement in a website or in a web application.

I will show how to implement the most important listed security features in ASP.NET Core application. For this demo, I have used the latest ASP.NET Core 3.1 version. However, you can apply this to a lower version like 2.0, 2.1, and 2.2 as well.

Security Feature in ASP.NET Core

Problem Statement

Most of us create ASP.NET Core application using the default template using Visual Studio IDE. The created template does not have the security feature implemented by default.

Missing security implementation will have this kind of response from an API

Security Feature Implementation

I will show how to implement all the listed security features using Middleware in ASP.NET Core. The complete working code is available in GitHub for your reference.

Create a folder named “Middleware” in your project that keeps us separated for readability.

Now, add a file named CspSettings which should have the properties shown in the below code.

namespace KarthikTechBlog.SecurityFeatures.API
{
    public class CspSettings
    {
        public string Default { get; set; }
        public string Image { get; set; }
        public string Style { get; set; }
        public string Font { get; set; }
        public string Script { get; set; }
        public bool UseHttps { get; set; }
        public bool BlockMixedContent { get; set; }
    }
}

Add a file named MiddlewareExtensions and copy paste the below code.

using Microsoft.AspNetCore.Builder;
using System;

namespace KarthikTechBlog.SecurityFeatures.API
{
    public static class MiddlewareExtensions
    {
        public static IApplicationBuilder UseSecurityHeader(this IApplicationBuilder app)
        {
            if (app == null)
            {
                throw new ArgumentNullException(nameof(app));
            }

            return app.UseMiddleware(new CspSettings
            {
                Default = "'self' https://*.karthiktechblog.com",
                Image = "'self' data: https://*.karthiktechblog.com",
                Style = "'self' 'unsafe-inline' https://*.karthiktechblog.com",
                Font = "'self' data: * https://*.karthiktechblog.com",
                Script = "'self' 'unsafe-inline' https://*.karthiktechblog.com",
                BlockMixedContent = true,
                UseHttps = true
            });
        }

        public static IApplicationBuilder UseSecurityHeader(
            this IApplicationBuilder app,
            Action configure)
        {
            if (app == null)
            {
                throw new ArgumentNullException(nameof(app));
            }

            if (configure == null)
            {
                throw new ArgumentNullException(nameof(configure));
            }

            var settings = new CspSettings();
            configure(settings);
            return app.UseMiddleware(settings);
        }
    }
}

Now add a file named SecurityHeader and copy the below code to it.

using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
using System;
using System.Threading.Tasks;

namespace KarthikTechBlog.SecurityFeatures.API
{
    /// 
    /// A middleware for adding security headers.
    ///

hsts Archives - Learn Smart Coding