| | | 1 | | using ProjectTemplate.Web.Middleware; |
| | | 2 | | using ProjectTemplate.Web.Options; |
| | | 3 | | |
| | | 4 | | namespace ProjectTemplate.Web.Extensions; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// Provides extension methods to register and enable security headers functionality. |
| | | 8 | | /// </summary> |
| | | 9 | | public static class SecurityHeadersExtensions |
| | | 10 | | { |
| | | 11 | | /// <summary> |
| | | 12 | | /// Registers the <see cref="ApplicationSecurityHeadersOptions"/> configuration section with the DI container. |
| | | 13 | | /// </summary> |
| | | 14 | | /// <param name="services">The service collection to add the configuration to.</param> |
| | | 15 | | /// <param name="configuration">The application configuration containing the "SecurityHeaders" section.</param> |
| | | 16 | | /// <returns>The original <see cref="IServiceCollection"/> for chaining.</returns> |
| | | 17 | | public static IServiceCollection AddApplicationSecurityHeaders( |
| | | 18 | | this IServiceCollection services, |
| | | 19 | | IConfiguration configuration) |
| | | 20 | | { |
| | 152 | 21 | | services |
| | 152 | 22 | | .AddOptions<ApplicationSecurityHeadersOptions>() |
| | 152 | 23 | | .Bind(configuration.GetSection(ApplicationSecurityHeadersOptions.SectionName)) |
| | 152 | 24 | | .Validate( |
| | 152 | 25 | | options => |
| | 258 | 26 | | !options.EnableContentSecurityPolicy || |
| | 258 | 27 | | !string.IsNullOrWhiteSpace(options.ContentSecurityPolicy), |
| | 152 | 28 | | "ProjectTemplate:SecurityHeaders:ContentSecurityPolicy is required when CSP is enabled.") |
| | 152 | 29 | | .Validate( |
| | 152 | 30 | | options => |
| | 258 | 31 | | !options.EnablePermissionsPolicy || |
| | 258 | 32 | | !string.IsNullOrWhiteSpace(options.PermissionsPolicy), |
| | 152 | 33 | | "ProjectTemplate:SecurityHeaders:PermissionsPolicy is required when Permissions-Policy is enabled.") |
| | 152 | 34 | | .Validate( |
| | 152 | 35 | | options => |
| | 258 | 36 | | options.ExcludedPathPrefixes.All(path => |
| | 1284 | 37 | | !string.IsNullOrWhiteSpace(path) && |
| | 1284 | 38 | | path.StartsWith('/')), |
| | 152 | 39 | | "ProjectTemplate:SecurityHeaders:ExcludedPathPrefixes values must start with '/'.") |
| | 152 | 40 | | .ValidateOnStart(); |
| | | 41 | | |
| | 152 | 42 | | return services; |
| | | 43 | | } |
| | | 44 | | |
| | | 45 | | /// <summary> |
| | | 46 | | /// Adds the security headers middleware to the application's request pipeline. |
| | | 47 | | /// </summary> |
| | | 48 | | /// <param name="app">The application builder used to configure the request pipeline.</param> |
| | | 49 | | /// <returns>The original <see cref="IApplicationBuilder"/> for chaining.</returns> |
| | | 50 | | public static IApplicationBuilder UseApplicationSecurityHeaders( |
| | | 51 | | this IApplicationBuilder app) |
| | | 52 | | { |
| | 142 | 53 | | return app.UseMiddleware<SecurityHeadersMiddleware>(); |
| | | 54 | | } |
| | | 55 | | } |
| | | 56 | | |