How to add HTTP Strict Transport Security and other security items to the outbound headers

Question

I did a security analysis (https://securityheaders.com/) of our site that is hosted on a Linux App Service server. Our app is in a Docker container. The results indicated that we need to add multiple items to the headers:

Strict-Transport-Security

• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy

I've added a web.config file with the code from this post (https://learn.microsoft.com/en-us/answers/questions/383935/hsts-and-x-xss-in-web-app-linux), but it doesn't seem to working. I've seen a reference that web.config only applies to Windows Server environments, so this is a bit confusing.

Any help would be greatly appreciated!

Answer 1

Hi @David Wipper

You’re correct, the web.config file is typically used in Windows environments, specifically with IIS servers.

Since your app is running in a Docker container on a Linux App Service, Nginx is used instead of IIS.

Here are a couple options to add security headers on a Linux App Service:

1. Modify your application code to add the headers directly. For example in Node.js:

   
   const helmet = require('helmet') 

app.use(helmet()) 
   

1. Use the Azure Front Door service and configure custom response headers there:

• Add your App Service as the origin backend pool in Front Door
• Under "Rules Engine", create a new rule to modify response headers
• Add your security headers like Strict-Transport-Security, X-XSS-Protection, X-Frame-Options, etc

This will apply the headers to all responses coming from your App Service through Front Door.