From 6d6058d16ab9e621b6fa8fc5385bd45a058e4236 Mon Sep 17 00:00:00 2001 From: Tommy Parnell Date: Sat, 31 Dec 2016 06:24:33 -0500 Subject: [PATCH] ieNoOpen, Referrer --- .vscode/launch.json | 42 ++++++ .vscode/tasks.json | 16 ++ Readme.md | 4 +- src/HardHat.Example/Project_Readme.html | 187 ------------------------ src/HardHat.Example/Startup.cs | 3 +- src/HardHat/Constants.cs | 29 +++- src/HardHat/Extensions.cs | 25 +--- src/HardHat/FrameGuard.cs | 2 - src/HardHat/IENoOpen.cs | 20 +++ src/HardHat/RefererPolicy.cs | 41 ++++++ 10 files changed, 150 insertions(+), 219 deletions(-) create mode 100644 .vscode/launch.json create mode 100644 .vscode/tasks.json delete mode 100644 src/HardHat.Example/Project_Readme.html create mode 100644 src/HardHat/IENoOpen.cs create mode 100644 src/HardHat/RefererPolicy.cs diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 0000000..0c1ceb8 --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,42 @@ +{ + "version": "0.2.0", + "configurations": [ + { + "name": ".NET Core Launch (web)", + "type": "coreclr", + "request": "launch", + "preLaunchTask": "build", + "program": "${workspaceRoot}\\src\\HardHat.Example\\bin\\Debug\\netcoreapp1.0\\HardHat.Example.dll", + "args": [], + "cwd": "${workspaceRoot}", + "stopAtEntry": false, + "internalConsoleOptions": "openOnSessionStart", + "launchBrowser": { + "enabled": true, + "args": "${auto-detect-url}", + "windows": { + "command": "cmd.exe", + "args": "/C start ${auto-detect-url}" + }, + "osx": { + "command": "open" + }, + "linux": { + "command": "xdg-open" + } + }, + "env": { + "ASPNETCORE_ENVIRONMENT": "Development" + }, + "sourceFileMap": { + "/Views": "${workspaceRoot}/Views" + } + }, + { + "name": ".NET Core Attach", + "type": "coreclr", + "request": "attach", + "processId": "${command.pickProcess}" + } + ] +} \ No newline at end of file diff --git a/.vscode/tasks.json b/.vscode/tasks.json new file mode 100644 index 0000000..7b89b6c --- /dev/null +++ b/.vscode/tasks.json @@ -0,0 +1,16 @@ +{ + "version": "0.1.0", + "command": "dotnet", + "isShellCommand": true, + "args": [], + "tasks": [ + { + "taskName": "build", + "args": [ + "${workspaceRoot}\\src\\HardHat.Example\\project.json" + ], + "isBuildCommand": true, + "problemMatcher": "$msCompile" + } + ] +} \ No newline at end of file diff --git a/Readme.md b/Readme.md index 65168e8..5a4a2e9 100644 --- a/Readme.md +++ b/Readme.md @@ -13,6 +13,8 @@ In short this allows: app.DnsPrefetch(allow: false); //turn off dns prefetch to keep privacy of users on site app.AddFrameGuard(new FrameGuardOptions(FrameGuardOptions.FrameGuard.SAMEORIGIN)); //prevent content from being loaded in an iframe unless its within the same origin app.UseHsts(maxAge: 5000, includeSubDomains: true, preload: false); //enforce hsts + app.AddReferrerPolicy(ReferrerPolicy.NoReferrer); + app.AddIENoOpen(); ... app.UseMvc(routes => { @@ -30,8 +32,6 @@ In short this allows: todo: * CSP -* ie NoOpen * don't sniff mime type * XSS protection -* disable referer diff --git a/src/HardHat.Example/Project_Readme.html b/src/HardHat.Example/Project_Readme.html deleted file mode 100644 index 1a0f5b5..0000000 --- a/src/HardHat.Example/Project_Readme.html +++ /dev/null @@ -1,187 +0,0 @@ - - - - - Welcome to ASP.NET Core - - - - - - -
-
-

This application consists of:

-
    -
  • Sample pages using ASP.NET Core MVC
    • -
  • Bower for managing client-side libraries
    • -
  • Theming using Bootstrap
    • -
-
-
-

How to

- -
-
-

Overview

- -
-
-

Run & Deploy

- -
- - -
- - - diff --git a/src/HardHat.Example/Startup.cs b/src/HardHat.Example/Startup.cs index 7cdcb84..6302304 100644 --- a/src/HardHat.Example/Startup.cs +++ b/src/HardHat.Example/Startup.cs @@ -50,7 +50,8 @@ namespace HardHat.Example app.AddFrameGuard(new FrameGuardOptions(FrameGuardOptions.FrameGuard.SAMEORIGIN)); app.UseHsts(maxAge: 5000, includeSubDomains: true, preload: false); app.UseStaticFiles(); - + app.AddReferrerPolicy(ReferrerPolicy.NoReferrer); + app.AddIENoOpen(); app.UseMvc(routes => { routes.MapRoute( diff --git a/src/HardHat/Constants.cs b/src/HardHat/Constants.cs index 78d9e5e..329b700 100644 --- a/src/HardHat/Constants.cs +++ b/src/HardHat/Constants.cs @@ -5,13 +5,28 @@ using System.Threading.Tasks; namespace HardHat { - public static class Constants + internal static class Constants { - public static string DnsControlHeader = "X-DNS-Prefetch-Control"; - public static string FrameGuardHeader = "X-Frame-Options"; - public static string StrictTransportSecurity = "Strict-Transport-Security"; - public static string MaxAge = "max-age"; - public static string IncludeSubDomains = "; includeSubDomains"; - public static string Preload = "; preload"; + internal const string DnsControlHeader = "X-DNS-Prefetch-Control"; + internal const string FrameGuardHeader = "X-Frame-Options"; + internal const string StrictTransportSecurity = "Strict-Transport-Security"; + internal const string MaxAge = "max-age"; + internal const string IncludeSubDomains = "; includeSubDomains"; + internal const string Preload = "; preload"; + internal const string DowloadOptions = "X-Download-Options"; + internal const string NoOpen = "noopen"; + internal const string ReferrerPolicy = "Referrer-Policy"; + + internal static class Referrers + { + internal const string NoReferrer = "no-referrer"; + internal const string NoReferrerWhenDowngrade = "no-referrer-when-downgrade"; + internal const string SameOrigin = "same-origin"; + internal const string Origin = "origin"; + internal const string StrictOrigin = "strict-origin"; + internal const string OriginWhenCrossOrigin = "origin-when-cross-origin"; + internal const string StrictOriginWhenCrossOrigin = "strict-origin-when-cross-origin"; + internal const string UnsafeUrl = "unsafe-url"; + } } } diff --git a/src/HardHat/Extensions.cs b/src/HardHat/Extensions.cs index 58e29d2..8cc00bf 100644 --- a/src/HardHat/Extensions.cs +++ b/src/HardHat/Extensions.cs @@ -1,28 +1,13 @@ using HardHat; -using Microsoft.AspNetCore.Builder; -using System; -using System.Collections.Generic; -using System.Linq; -using System.Threading.Tasks; namespace Microsoft.AspNetCore.Builder { public static class Extensions { - public static IApplicationBuilder DnsPrefetch(this IApplicationBuilder app, bool allow = false) - { - app.UseMiddleware(allow); - return app; - } - public static IApplicationBuilder AddFrameGuard(this IApplicationBuilder app, FrameGuardOptions options) - { - app.UseMiddleware(options); - return app; - } - public static IApplicationBuilder UseHsts(this IApplicationBuilder app, ulong maxAge, bool includeSubDomains = false, bool preload = false) - { - app.UseMiddleware(maxAge, includeSubDomains, preload); - return app; - } + public static IApplicationBuilder DnsPrefetch(this IApplicationBuilder app, bool allow = false) => app.UseMiddleware(allow); + public static IApplicationBuilder AddFrameGuard(this IApplicationBuilder app, FrameGuardOptions options) => app.UseMiddleware(options); + public static IApplicationBuilder UseHsts(this IApplicationBuilder app, ulong maxAge, bool includeSubDomains = false, bool preload = false) => app.UseMiddleware(maxAge, includeSubDomains, preload); + public static IApplicationBuilder AddIENoOpen(this IApplicationBuilder app) => app.UseMiddleware(); + public static IApplicationBuilder AddReferrerPolicy(this IApplicationBuilder app, ReferrerPolicy policy) => app.UseMiddleware(policy); } } diff --git a/src/HardHat/FrameGuard.cs b/src/HardHat/FrameGuard.cs index 13aa323..cd49f23 100644 --- a/src/HardHat/FrameGuard.cs +++ b/src/HardHat/FrameGuard.cs @@ -1,7 +1,5 @@ using Microsoft.AspNetCore.Http; using System; -using System.Collections.Generic; -using System.Linq; using System.Threading.Tasks; namespace HardHat diff --git a/src/HardHat/IENoOpen.cs b/src/HardHat/IENoOpen.cs new file mode 100644 index 0000000..ba7751b --- /dev/null +++ b/src/HardHat/IENoOpen.cs @@ -0,0 +1,20 @@ +using Microsoft.AspNetCore.Http; +using System.Threading.Tasks; + +namespace HardHat +{ + public class IENoOpen + { + private readonly RequestDelegate _next; + public IENoOpen(RequestDelegate next) + { + _next = next; + } + + public Task Invoke(HttpContext context) + { + context.Response.Headers[Constants.DowloadOptions] = Constants.NoOpen; + return _next.Invoke(context); + } + } +} diff --git a/src/HardHat/RefererPolicy.cs b/src/HardHat/RefererPolicy.cs new file mode 100644 index 0000000..e952839 --- /dev/null +++ b/src/HardHat/RefererPolicy.cs @@ -0,0 +1,41 @@ +using Microsoft.AspNetCore.Http; +using System.Threading.Tasks; + +namespace HardHat +{ + public class ReferrerPolicyMiddlewear + { + private readonly RequestDelegate _next; + private readonly ReferrerPolicy policy; + public ReferrerPolicyMiddlewear(RequestDelegate next, ReferrerPolicy policy) + { + this.policy = policy; + _next = next; + } + + public Task Invoke(HttpContext context) + { + context.Response.Headers[Constants.ReferrerPolicy] = this.policy.Policy; + return _next.Invoke(context); + } + } + public struct ReferrerPolicy + { + internal readonly string Policy; + internal ReferrerPolicy(string policy) + { + this.Policy = policy; + } + //todo: document https://www.w3.org/TR/referrer-policy/#referrer-policies + + public static readonly ReferrerPolicy Empty = new ReferrerPolicy(string.Empty); + public static readonly ReferrerPolicy NoReferrer = new ReferrerPolicy(Constants.Referrers.NoReferrer); + public static readonly ReferrerPolicy NoReferrerWhenDowngrade = new ReferrerPolicy(Constants.Referrers.NoReferrerWhenDowngrade); + public static readonly ReferrerPolicy SameOrigin = new ReferrerPolicy(Constants.Referrers.SameOrigin); + public static readonly ReferrerPolicy Origin = new ReferrerPolicy(Constants.Referrers.Origin); + public static readonly ReferrerPolicy StrictOrigin = new ReferrerPolicy(Constants.Referrers.StrictOrigin); + public static readonly ReferrerPolicy OriginWhenCrossOrigin = new ReferrerPolicy(Constants.Referrers.OriginWhenCrossOrigin); + public static readonly ReferrerPolicy StrictOriginWhenCrossOrigin = new ReferrerPolicy(Constants.Referrers.StrictOriginWhenCrossOrigin); + public static readonly ReferrerPolicy UnsafeUrl = new ReferrerPolicy(Constants.Referrers.UnsafeUrl); + } +}