Share via

Security headings

Maviso2022 1 Reputation point
2022-10-12T09:39:09.547+00:00

On a .NET Core web app hosted on Azure I would like to have the same security headings you can see on https://www.zebedeecreations.com/ like HSTS, x-content-options, x-xss-protection and x-frame-options.

On .NET Framework this was done on web.config but I’m not sure about how to configure this on the new Azure configuration or is it only possible injecting the headers at application level?

ASP.NET Core
ASP.NET Core
A set of technologies in the .NET Framework for building web applications and XML web services.
4,400 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
7,407 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ajkuma 24,971 Reputation points Microsoft Employee
    2022-10-13T20:12:11.427+00:00

    Maviso2022-6989,

    In App Service, TLS/SSL termination happens at the network load balancers, so all HTTPS requests reach your app as unencrypted HTTP requests.

    You could control (on all response headers) and include to return HSTS policy header explicitly. There is no App Service feature to enforce such policy on user's behalf.
    Just to highlight, App Services HttpsOnly is limited to redirect Http-Https but not extend to forcing single HSTS policy to all your users.

    You may take a look at this similar discussion App service security headers.

    If you have any further questions, please let us know.

    0 comments