andrewlock / NetEscapades.AspNetCore.SecurityHeaders

Small package to allow adding security headers to ASP.NET Core websites
MIT License
701 stars 73 forks source link

Remove "document header" functionality in favour of policy selector #186

Closed andrewlock closed 2 months ago

andrewlock commented 2 months ago

For some time, certain headers have been restricted to "document" headers.

This has always been a bit confusing, especially for people that didn't want this behaviour (e.g. see #133). With the work in #173, #174, and #185, we can allow users to choose how to customise the policies that are applied. e.g. we can have endpoint-specific policies, or we can customise on a per-request basis. Consequently, it makes sense to remove this niche functionality in favour of policy selector.

As part of that, need to expose the configured policies in the policy selector context.