How do I set the CSP and HSTS for an Azure app?

Question

I have created an Azure app and use a custom domain to access it. However, when putting the URL through our cyber security process, it came back that the CSP and HSTS needs to be updated. I cannot find where in Azure to update the security headers. Where can I update the CSP and HSTS for my app?

Answer 1

Hello Wilson, TaRan (Avison Young - US)

HSTS can be enabled in multiple ways: API Management - https://learn.microsoft.com/en-us/answers/questions/845443/add-hsts-to-an-azure-api-management-service

App Gateway -  https://techcommunity.microsoft.com/t5/azure/azure-application-gateway-app-service-secure-headers/m-p/2231277

App Service with Docker Containers - https://azureaggregator.wordpress.com/2022/10/31/adding-hsts-header-in-the-nginx-based-app-service/

Code - https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-8.0&tabs=visual-studio%2Clinux-ubuntu#options

Also If you want to follow best security practices and implement Strict Transport Security and Secure Headers in your Azure App Service you will need to add Security Headers in web.config or htaccess files in your web application’s root folder. https://itgala.xyz/implementing-security-headers-in-azure-app-service/