How to add Security Headers in Response from server

aspnet / KestrelHttpServer

[Archived] A cross platform web server for ASP.NET Core. Project moved to https://github.com/aspnet/AspNetCore

Apache License 2.0

2.63k stars 528 forks source link

How to add Security Headers in Response from server #3100

Closed Chetas1 closed 5 years ago

Chetas1 commented 5 years ago

Like in IIS server we have web.config file where if we add security headers like X-XSS-Protection , then in response we get that headers. Since i am using kestrel i am not getting where to add this security headers. Does this also has some configuration file where we could add security headers.

Tratcher commented 5 years ago

That wouldn't be done in Kestrel itself, it would be added via middleware. See https://github.com/aspnet/BasicMiddleware/issues/323 for the tracking issue and https://github.com/aspnet/Templating/issues/497#issuecomment-384765559 for an example.

Closing as a duplicate.