[{"data":1,"prerenderedAt":1064},["ShallowReactive",2],{"i-feather:search":3,"i-feather:x":8,"i-feather:moon":10,"i-feather:sun":12,"i-lucide:house-heart":14,"i-fa-brands:youtube":16,"i-fa-brands:twitch":20,"i-fa-brands:github":22,"i-fa-brands:linkedin":25,"i-fa-brands:stack-overflow":28,"i-simple-icons:bluesky":31,"i-fa-brands:mastodon":33,"i-fa-regular:envelope":35,"i-fa-solid:rss":37,"post-\u002Fnwebsec-asp-net-mvc-security-through-http-headers\u002F":39,"post-navigation":675,"i-fa-solid:share-alt":1044,"i-fa-brands:facebook":1046,"i-fa-brands:twitter":1048,"i-fa-brands:reddit":1050,"i-fa-brands:patreon":1052,"i-simple-icons:buymeacoffee":1054,"i-fa-brands:paypal":1056,"i-fa-regular:question-circle":1058,"i-feather:arrow-left":1060,"i-feather:arrow-right":1062},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"11\" cy=\"11\" r=\"8\"\u002F>\u003Cpath d=\"m21 21l-4.35-4.35\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M21 12.79A9 9 0 1 1 11.21 3A7 7 0 0 0 21 12.79\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"5\"\u002F>\u003Cpath d=\"M12 1v2m0 18v2M4.22 4.22l1.42 1.42m12.72 12.72l1.42 1.42M1 12h2m18 0h2M4.22 19.78l1.42-1.42M18.36 5.64l1.42-1.42\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8.62 13.8A2.25 2.25 0 1 1 12 10.836a2.25 2.25 0 1 1 3.38 2.966l-2.626 2.856a.998.998 0 0 1-1.507 0z\"\u002F>\u003Cpath d=\"M3 10a2 2 0 0 1 .709-1.528l7-6a2 2 0 0 1 2.582 0l7 6A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":17,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":19},576,512,"\u003Cpath fill=\"currentColor\" d=\"M549.655 124.083c-6.281-23.65-24.787-42.276-48.284-48.597C458.781 64 288 64 288 64S117.22 64 74.629 75.486c-23.497 6.322-42.003 24.947-48.284 48.597c-11.412 42.867-11.412 132.305-11.412 132.305s0 89.438 11.412 132.305c6.281 23.65 24.787 41.5 48.284 47.821C117.22 448 288 448 288 448s170.78 0 213.371-11.486c23.497-6.321 42.003-24.171 48.284-47.821c11.412-42.867 11.412-132.305 11.412-132.305s0-89.438-11.412-132.305m-317.51 213.508V175.185l142.739 81.205z\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":21},"\u003Cpath fill=\"currentColor\" d=\"M391.17 103.47h-38.63v109.7h38.63ZM285 103h-38.63v109.75H285ZM120.83 0L24.31 91.42v329.16h115.83V512l96.53-91.42h77.25L487.69 256V0Zm328.24 237.75l-77.22 73.12h-77.24l-67.6 64v-64h-86.87V36.58h308.93Z\"\u002F>",{"left":4,"top":4,"width":23,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":24},496,"\u003Cpath fill=\"currentColor\" d=\"M165.9 397.4c0 2-2.3 3.6-5.2 3.6c-3.3.3-5.6-1.3-5.6-3.6c0-2 2.3-3.6 5.2-3.6c3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9c2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9c.3 2 2.9 3.3 5.9 2.6c2.9-.7 4.9-2.6 4.6-4.6c-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2c12.8 2.3 17.3-5.6 17.3-12.1c0-6.2-.3-40.4-.3-61.4c0 0-70 15-84.7-29.8c0 0-11.4-29.1-27.8-36.6c0 0-22.9-15.7 1.6-15.4c0 0 24.9 2 38.6 25.8c21.9 38.6 58.6 27.5 72.9 20.9c2.3-16 8.8-27.1 16-33.7c-55.9-6.2-112.3-14.3-112.3-110.5c0-27.5 7.6-41.3 23.6-58.9c-2.6-6.5-11.1-33.3 2.6-67.9c20.9-6.5 69 27 69 27c20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27c13.7 34.7 5.2 61.4 2.6 67.9c16 17.7 25.8 31.5 25.8 58.9c0 96.5-58.9 104.2-114.8 110.5c9.2 7.9 17 22.9 17 46.4c0 33.7-.3 75.4-.3 83.6c0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252C496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2c1.6 1.6 3.9 2.3 5.2 1c1.3-1 1-3.3-.7-5.2c-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9c1.6 1 3.6.7 4.3-.7c.7-1.3-.3-2.9-2.3-3.9c-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2c2.3 2.3 5.2 2.6 6.5 1c1.3-1.3.7-4.3-1.3-6.2c-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2c-1.4-2.3-4-3.3-5.6-2\"\u002F>",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":27},448,"\u003Cpath fill=\"currentColor\" d=\"M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5c0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7c-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5c67.2 0 79.7 44.3 79.7 101.9z\"\u002F>",{"left":4,"top":4,"width":29,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":30},384,"\u003Cpath fill=\"currentColor\" d=\"M290.7 311L95 269.7L86.8 309l195.7 41zm51-87L188.2 95.7l-25.5 30.8l153.5 128.3zm-31.2 39.7L129.2 179l-16.7 36.5L293.7 300zM262 32l-32 24l119.3 160.3l32-24zm20.5 328h-200v39.7h200zm39.7 80H42.7V320h-40v160h359.5V320h-40z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":32},"\u003Cpath fill=\"currentColor\" d=\"M5.202 2.857C7.954 4.922 10.913 9.11 12 11.358c1.087-2.247 4.046-6.436 6.798-8.501C20.783 1.366 24 .213 24 3.883c0 .732-.42 6.156-.667 7.037c-.856 3.061-3.978 3.842-6.755 3.37c4.854.826 6.089 3.562 3.422 6.299c-5.065 5.196-7.28-1.304-7.847-2.97c-.104-.305-.152-.448-.153-.327c0-.121-.05.022-.153.327c-.568 1.666-2.782 8.166-7.847 2.97c-2.667-2.737-1.432-5.473 3.422-6.3c-2.777.473-5.899-.308-6.755-3.369C.42 10.04 0 4.615 0 3.883c0-3.67 3.217-2.517 5.202-1.026\"\u002F>",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":34},"\u003Cpath fill=\"currentColor\" d=\"M433 179.11c0-97.2-63.71-125.7-63.71-125.7c-62.52-28.7-228.56-28.4-290.48 0c0 0-63.72 28.5-63.72 125.7c0 115.7-6.6 259.4 105.63 289.1c40.51 10.7 75.32 13 103.33 11.4c50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7c56.12-6.7 105-41.3 111.23-72.9c9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175c25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5l11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1c23.71 27.3 18.4 53 18.4 175z\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":36},"\u003Cpath fill=\"currentColor\" d=\"M464 64H48C21.49 64 0 85.49 0 112v288c0 26.51 21.49 48 48 48h416c26.51 0 48-21.49 48-48V112c0-26.51-21.49-48-48-48m0 48v40.805c-22.422 18.259-58.168 46.651-134.587 106.49c-16.841 13.247-50.201 45.072-73.413 44.701c-23.208.375-56.579-31.459-73.413-44.701C106.18 199.465 70.425 171.067 48 152.805V112zM48 400V214.398c22.914 18.251 55.409 43.862 104.938 82.646c21.857 17.205 60.134 55.186 103.062 54.955c42.717.231 80.509-37.199 103.053-54.947c49.528-38.783 82.032-64.401 104.947-82.653V400z\"\u002F>",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":38},"\u003Cpath fill=\"currentColor\" d=\"M128.081 415.959c0 35.369-28.672 64.041-64.041 64.041S0 451.328 0 415.959s28.672-64.041 64.041-64.041s64.04 28.673 64.04 64.041m175.66 47.25c-8.354-154.6-132.185-278.587-286.95-286.95C7.656 175.765 0 183.105 0 192.253v48.069c0 8.415 6.49 15.472 14.887 16.018c111.832 7.284 201.473 96.702 208.772 208.772c.547 8.397 7.604 14.887 16.018 14.887h48.069c9.149.001 16.489-7.655 15.995-16.79m144.249.288C439.596 229.677 251.465 40.445 16.503 32.01C7.473 31.686 0 38.981 0 48.016v48.068c0 8.625 6.835 15.645 15.453 15.999c191.179 7.839 344.627 161.316 352.465 352.465c.353 8.618 7.373 15.453 15.999 15.453h48.068c9.034-.001 16.329-7.474 16.005-16.504\"\u002F>",{"id":40,"title":41,"author":42,"body":43,"comments":582,"date":648,"dateModified":649,"description":650,"extension":651,"headings":652,"heroImage":663,"meta":664,"path":75,"permalink":75,"published":665,"stem":666,"tags":667,"timeToRead":674},"posts\u002Fposts\u002F2015\u002Fnwebsec-asp-net-mvc-security-through-http-headers\u002Findex.md","NWebSec ASP.NET MVC Security Through HTTP Headers","Muhammad Rehan Saeed",{"type":44,"value":45,"toc":579},"minimark",[46,113,136,159,162,169,190,206,217,235,238,249,252,271,283,294,306,312,349,358,365,372,383,401,408,411,420,423,433,444,454,457,468,474,477,488,502,523,526,529,538,549,556,566,575],[47,48,49,57,82,101,107],"ul",{},[50,51,52],"li",{},[53,54,56],"a",{"href":55},"\u002Fasp-net-mvc-boilerplate\u002F","ASP.NET Core Boilerplate",[50,58,59,63],{},[60,61,62],"p",{},"Security",[47,64,65,71,76],{},[50,66,67],{},[53,68,70],{"href":69},"\u002Fsecuring-the-aspnet-mvc-web-config\u002F","Securing the ASP.NET MVC Web.config (Updated)",[50,72,73],{},[53,74,41],{"href":75},"\u002Fnwebsec-asp-net-mvc-security-through-http-headers\u002F",[50,77,78],{},[53,79,81],{"href":80},"\u002Fcontent-security-policy-for-asp-net-mvc\u002F","Content Security Policy (CSP) for ASP.NET MVC",[50,83,84,87],{},[60,85,86],{},"Search Engine Optimization (SEO)",[47,88,89,95],{},[50,90,91],{},[53,92,94],{"href":93},"\u002Fcanonical-urls-for-asp-net-mvc\u002F","Canonical URL's for ASP.NET MVC",[50,96,97],{},[53,98,100],{"href":99},"\u002Fdynamically-generating-robots-txt-using-asp-net-mvc","Dynamically Generating Robots.txt Using ASP.NET MVC",[50,102,103],{},[53,104,106],{"href":105},"\u002Finternet-favicon-madness\u002F","Internet Favicon Madness (Updated)",[50,108,109],{},[53,110,112],{"href":111},"\u002Fbuilding-rssatom-feeds-for-asp-net-mvc\u002F","Building RSS\u002FAtom Feeds for ASP.NET MVC",[60,114,115,116,124,125,130,131,135],{},"This series of blog posts goes through the additions made to the default ASP.NET MVC project template to build the ",[53,117,56],{"href":118,"rel":119,"target":123},"https:\u002F\u002Fgithub.com\u002FDotnet-Boxed\u002FTemplates",[120,121,122],"nofollow","noopener","noreferrer","_blank"," project template. You can create a new project using this template by installing the ",[53,126,129],{"href":127,"rel":128,"target":123},"https:\u002F\u002Fvisualstudiogallery.msdn.microsoft.com\u002F6cf50a48-fc1e-4eaf-9e82-0b2a6705ca7d",[120,121,122],"Visual Studio extension"," or visit the ",[53,132,134],{"href":118,"rel":133,"target":123},[120,121,122],"GitHub"," site to view the source code.",[137,138,140,158],"h1",{"id":139},"web-security-is-hard",[53,141,144],{"href":142,"aria-hidden":143},"#web-security-is-hard","true",[145,146,152],"svg",{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},"http:\u002F\u002Fwww.w3.org\u002F2000\u002Fsvg","http:\u002F\u002Fwww.w3.org\u002F1999\u002Fxlink","0 0 16 16","1.1",22,[153,154],"path",{"fill":155,"fill-rule":156,"d":157},"currentColor","evenodd","M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z","Web Security is Hard",[60,160,161],{},"Security is hard at the best of times. Web security...well...it takes things to a whole new level of difficulty. It is ridiculously easy to slip up and leave holes in your sites defences.",[60,163,164,165,168],{},"This blog post as well as the ",[53,166,56],{"href":118,"rel":167,"target":123},[120,121,122]," project are not a replacement for your own knowledge but it does help in setting up some defaults to be more secure and giving you a few more tools out of the box to help secure your site.",[60,170,171,172,177,178,183,184,189],{},"If you have some time and want to learn more about web security I highly recommend ",[53,173,176],{"href":174,"rel":175,"target":123},"http:\u002F\u002Fwww.troyhunt.com",[120,121,122],"Troy Hunt","'s Pluralsight course called ",[53,179,182],{"href":180,"rel":181,"target":123},"http:\u002F\u002Fwww.pluralsight.com\u002Fcourses\u002Fhack-yourself-first",[120,121,122],"Hack yourself first",". Note that Pluralsight requires a paid subscription (I'm quite against posting links to paid content but this course is pretty good. You can also get a trial subscription if you're interested). ",[53,185,188],{"href":186,"rel":187,"target":123},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=rdHD6pVG66Q",[120,121,122],"Here"," is a free video by Troy which covers the same topic but in a little less depth.",[60,191,192,193,196,197,201,202,205],{},"I would also, highly recommend reading up on ",[53,194,176],{"href":174,"rel":195,"target":123},[120,121,122],"'s blog which has extensive examples of real life websites in the wild, written by ",[198,199,200],"strong",{},"major"," companies getting web security ",[198,203,204],{},"horribly"," wrong.",[137,207,209,216],{"id":208},"nwebsec",[53,210,212],{"href":211,"aria-hidden":143},"#nwebsec",[145,213,214],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,215],{"fill":155,"fill-rule":156,"d":157},"NWebSec",[60,218,219,220,224,225,230,231,234],{},"The ",[53,221,216],{"href":222,"rel":223,"target":123},"https:\u002F\u002Fgithub.com\u002FNWebsec\u002FNWebsec",[120,121,122]," NuGet packages written by ",[53,226,229],{"href":227,"rel":228,"target":123},"http:\u002F\u002Fwww.dotnetnoob.com\u002F",[120,121,122],"André N. Klingsheim"," are a great way to add additional security to your ASP.NET MVC site. The ",[53,232,56],{"href":118,"rel":233,"target":123},[120,121,122]," project template includes them by default.",[60,236,237],{},"Everything is preconfigured and commented as much as possible out of the box but remember this is a project template to get you started. You still need to put the effort in to customize the site security to your own requirements and put in some time learning about what each of the security features does and how best to use it.",[137,239,241,248],{"id":240},"http-headers",[53,242,244],{"href":243,"aria-hidden":143},"#http-headers",[145,245,246],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,247],{"fill":155,"fill-rule":156,"d":157},"HTTP Headers",[60,250,251],{},"HTTP has been around for a very long time and so, a fairly large number of HTTP headers have been accumulated over time. Some are more useful than others but many of them are aimed at making the web more secure.",[60,253,254,258,259,264,265,270],{},[53,255,229],{"href":256,"rel":257,"target":123},"http:\u002F\u002Fwww.dotnetnoob.com",[120,121,122]," has a brilliant blog post called ",[53,260,263],{"href":261,"rel":262,"target":123},"http:\u002F\u002Fwww.dotnetnoob.com\u002F2012\u002F09\u002Fsecurity-through-http-response-headers.html",[120,121,122],"Security through HTTP response headers"," which is a must read and fairly comprehensive. Go on, I'll wait for you to finish reading. NWebSec provides a host of ",[53,266,269],{"href":267,"rel":268,"target":123},"http:\u002F\u002Fwww.asp.net\u002Fmvc\u002Foverview\u002Folder-versions-1\u002Fcontrollers-and-routing\u002Funderstanding-action-filters-cs",[120,121,122],"ActionFilterAttribute","'s (The rest of this post expects you to know what these are) which can be applied in three different ways:",[272,273,274,277,280],"ol",{},[50,275,276],{},"Applied globally, so that they apply to all HTTP request\u002Fresponse messages.",[50,278,279],{},"Applied to individual controllers.",[50,281,282],{},"Applied to individual controller actions.",[60,284,285,286,289,290,293],{},"NWebSec's ",[53,287,269],{"href":267,"rel":288,"target":123},[120,121,122],"'s add and configure specific HTTP headers. Most of them are preconfigured in ",[53,291,56],{"href":118,"rel":292,"target":123},[120,121,122]," for you to apply globally but some require you to take action.",[295,296,298,305],"h2",{"id":297},"x-frame-options",[53,299,301],{"href":300,"aria-hidden":143},"#x-frame-options",[145,302,303],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,304],{"fill":155,"fill-rule":156,"d":157},"X-Frame-Options",[60,307,219,308,311],{},[309,310,305],"code",{}," HTTP header stops click-jacking by stopping the page from opening in an iframe or only allowing it from the same origin (your domain). There are three options to choose from:",[47,313,314,330,341],{},[50,315,316,319,320,322,323,326,327,329],{},[198,317,318],{},"SameOrigin"," - Specifies that the ",[309,321,305],{}," header should be set in the HTTP response, instructing the browser to display the page when it is loaded in an ",[309,324,325],{},"iframe"," - but only if the ",[309,328,325],{}," is from the same origin as the page.",[50,331,332,319,335,337,338,340],{},[198,333,334],{},"Deny",[309,336,305],{}," header should be set in the HTTP response, instructing the browser to not display the page when it is loaded in an ",[309,339,325],{},".",[50,342,343,319,346,348],{},[198,344,345],{},"Disabled",[309,347,305],{}," header should not be set in the HTTP response.",[60,350,351,352,354,355,340],{},"We can use NWebSec to set it to block all ",[309,353,325],{},"'s from loading the site which is the most secure option and the default option set in ",[53,356,56],{"href":118,"rel":357,"target":123},[120,121,122],[359,360],"pre",{"className":361,"language":362,"meta":363,"style":363,"html":364},"language-cs shiki shiki-themes light-plus monokai","cs","","\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F Filters is the GlobalFilterCollection from GlobalFilters.Filters\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> XFrameOptionsAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        Policy\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sFrd5\"> XFrameOptionsPolicy\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">Deny\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,366,367,368,371],{},"You should note that for newer browsers, this HTTP header has become superseded by the ",[309,369,370],{},"Content-Security-Policy"," HTTP header which I will be covering in my next blog post. However, it should still be used for older browsers.",[295,373,375,382],{"id":374},"strict-transport-security",[53,376,378],{"href":377,"aria-hidden":143},"#strict-transport-security",[145,379,380],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,381],{"fill":155,"fill-rule":156,"d":157},"Strict-Transport-Security",[60,384,385,386,391,392,395,396,340],{},"This HTTP header is only relevant if you are using ",[53,387,390],{"href":388,"rel":389,"target":123},"http:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTransport_Layer_Security",[120,121,122],"TLS",". It ensures that content is loaded over HTTPS and refuses to connect in case of certificate errors and warnings. You can read a complete guide to setting up your site to run with a ",[198,393,394],{},"free"," TLS certificate ",[53,397,400],{"href":398,"rel":399,"target":123},"http:\u002F\u002Fwww.troyhunt.com\u002F2013\u002F09\u002Fthe-complete-guide-to-loading-free-ssl.html",[120,121,122],"here",[60,402,403,404,407],{},"NWebSec currently does not support an MVC filter that can be applied globally. Instead we can use the Owin (Using the added ",[309,405,406],{},"NWebSec.Owin"," NuGet package) extension to apply it.",[359,409],{"className":361,"language":362,"meta":363,"style":363,"html":410},"\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">app\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">UseHsts\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">options\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =>\u003C\u002Fspan>\u003Cspan class=\"sFrd5\"> options\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">MaxAge\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">days\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">:\u003C\u002Fspan>\u003Cspan class=\"s0PsH\">30\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">).\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">IncludeSubdomains\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">());\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,412,413,414,419],{},"As well as this header, MVC ships with the ",[53,415,418],{"href":416,"rel":417,"target":123},"https:\u002F\u002Fmsdn.microsoft.com\u002Fen-us\u002Flibrary\u002Fsystem.web.mvc.requirehttpsattribute%28v=vs.118%29.aspx",[120,121,122],"RequireHttpsAttribute",". This forces an unsecured HTTP request to be re-sent over HTTPS. It does so without requiring any extra HTTP headers. Instead, this is a function of the MVC framework itself, which checks requests and simply redirects users if they send a normal HTTP request to a HTTPS URL. This attribute can be set globally (Using HTTPS throughout your site is a good idea these days) as shown below:",[359,421],{"className":361,"language":362,"meta":363,"style":363,"html":422},"\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> RequireHttpsAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">());\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,424,425,426,428,429,432],{},"Both of these lines of code have an overlapping purpose but work in different ways. The ",[309,427,418],{}," uses the MVC framework, while the NWebSec option relies on browsers responding to the Strict-Transport-Security HTTP header. Security should be applied in thick layers, so it's worth using both features. ",[53,430,56],{"href":118,"rel":431,"target":123},[120,121,122]," assumes you are not using TLS by default but does include the above lines of code commented out with a liberal sprinkling of comments to make it easy to add back in.",[295,434,436,443],{"id":435},"x-content-type-options",[53,437,439],{"href":438,"aria-hidden":143},"#x-content-type-options",[145,440,441],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,442],{"fill":155,"fill-rule":156,"d":157},"X-Content-Type-Options",[60,445,446,447,450,451,340],{},"This HTTP header stops IE9 and below from sniffing files and overriding the ",[309,448,449],{},"Content-Type"," header (MIME type) of a HTTP response. This filter is added by default in ",[53,452,56],{"href":118,"rel":453,"target":123},[120,121,122],[359,455],{"className":361,"language":362,"meta":363,"style":363,"html":456},"\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> XContentTypeOptionsAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">());\n\u003C\u002Fspan>\u003C\u002Fspan>",[295,458,460,467],{"id":459},"x-download-options",[53,461,463],{"href":462,"aria-hidden":143},"#x-download-options",[145,464,465],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,466],{"fill":155,"fill-rule":156,"d":157},"X-Download-Options",[60,469,470,471,340],{},"This HTTP header stops the automatic downloading and opening of your HTML pages by browsers which then go on to run the page as if it were part of your site. It and forces the user to save the page and manually open the HTML document. This filter is added by default in ",[53,472,56],{"href":118,"rel":473,"target":123},[120,121,122],[359,475],{"className":361,"language":362,"meta":363,"style":363,"html":476},"\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> XDownloadOptionsAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">());\n\u003C\u002Fspan>\u003C\u002Fspan>",[295,478,480,487],{"id":479},"other-http-headers",[53,481,483],{"href":482,"aria-hidden":143},"#other-http-headers",[145,484,485],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,486],{"fill":155,"fill-rule":156,"d":157},"Other HTTP Headers",[60,489,490,493,494,497,498,501],{},[53,491,216],{"href":222,"rel":492,"target":123},[120,121,122]," provides a number of other useful HTTP headers. The ",[309,495,496],{},"SetNoCacheHttpHeadersAttribute"," helps turn off caching by applying the ",[309,499,500],{},"Cache-Control",", Expires and Pragma HTTP headers (Expires and Pragma have been superseded by Cache-Control but still need to be applied for backward compatibility).",[60,503,504,505,508,509,512,513,516,517,522],{},"Another useful filter provided is ",[309,506,507],{},"XRobotsTagAttribute",". This adds the ",[309,510,511],{},"X-Robots-Tag"," HTTP header, which tells robots (Google or Bing) not to index any action or controller this attribute is applied to. Note, that ",[53,514,56],{"href":118,"rel":515,"target":123},[120,121,122]," includes a ",[53,518,521],{"href":519,"rel":520,"target":123},"http:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRobots_exclusion_standard",[120,121,122],"robots.txt"," file which you should use instead of this filter but I've added this here for completeness.",[60,524,525],{},"A good place to use these attributes would be on a page where you want to post back credit card information because caching credit card information could be a security risk and you probably don't want search engines indexing your checkout pages either.",[359,527],{"className":361,"language":362,"meta":363,"style":363,"html":528},"\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">public\u003C\u002Fspan>\u003Cspan class=\"s4J9F\"> class\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CheckoutController\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> : \u003C\u002Fspan>\u003Cspan class=\"sw29p\">Controller\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">{\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    [\u003C\u002Fspan>\u003Cspan class=\"sw29p\">SetNoCacheHttpHeadersAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">, \u003C\u002Fspan>\u003Cspan class=\"sw29p\">XRobotsTagAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">NoIndex\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">, \u003C\u002Fspan>\u003Cspan class=\"sFrd5\">NoFollow\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">)]\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    public\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> ActionResult\u003C\u002Fspan>\u003Cspan class=\"sWm5y\"> Checkout\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sw29p\">CardDetails\u003C\u002Fspan>\u003Cspan class=\"sFrd5\"> cardDetails\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">)\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Checkout customers purchases securely.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    }\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">}\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,530,219,531,534,535,537],{},[309,532,533],{},"CspAttribute"," filter adds valuable support for the new ",[309,536,370],{}," (CSP) HTTP header. I will be covering this extensively in my next blog post so I've only mentioned it here. There are other HTTP headers but they turn off browser security features and I'm not really sure why you would use those.",[137,539,541,548],{"id":540},"conclusions",[53,542,544],{"href":543,"aria-hidden":143},"#conclusions",[145,545,546],{"xmlns":147,"xmlns:xlink":148,"viewBox":149,"version":150,"width":151,"height":151,"aria-hidden":143},[153,547],{"fill":155,"fill-rule":156,"d":157},"Conclusions",[60,550,551,552,555],{},"In the image below, you can see the ",[53,553,56],{"href":118,"rel":554,"target":123},[120,121,122]," site in action. I've taken a screenshot of the HTTP response headers. You will see the ones listed in this email among them.",[60,557,558],{},[559,560],"img",{"alt":561,"src":562,"width":563,"height":564,"loading":565},"ASP.NET Core Boilerplate HTTP Response Headers","\u002Fcontent-images\u002Fposts\u002F2015\u002Fnwebsec-asp-net-mvc-security-through-http-headers\u002Fimages\u002FASP.NET-MVC-Boilerplate-HTTP-Response-Headers.png",1019,712,"lazy",[60,567,568,569,574],{},"Using HTTP headers for security is just one extra tool in your arsenal to secure your site. As you will see in my next post about the new ",[53,570,573],{"href":571,"rel":572,"target":123},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FSecurity\u002FCSP",[120,121,122],"Content-Security-Policy (CSP)"," HTTP header, it can be a very powerful tool but not one to be used in isolation. You need to think about security across the whole spectrum of your site to catch all the glaring holes you may have missed.",[576,577,578],"style",{},"html pre.shiki code .s1q82, html code.shiki .s1q82{--shiki-default:#008000;--shiki-dark:#88846F}html pre.shiki code .sFrd5, html code.shiki .sFrd5{--shiki-default:#001080;--shiki-dark:#F8F8F2}html pre.shiki code .sjLUg, html code.shiki .sjLUg{--shiki-default:#000000;--shiki-dark:#F8F8F2}html pre.shiki code .sWm5y, html code.shiki .sWm5y{--shiki-default:#795E26;--shiki-dark:#A6E22E}html pre.shiki code .sJvqV, html code.shiki .sJvqV{--shiki-default:#0000FF;--shiki-dark:#F92672}html pre.shiki code .sw29p, html code.shiki .sw29p{--shiki-default:#267F99;--shiki-default-text-decoration:inherit;--shiki-dark:#A6E22E;--shiki-dark-text-decoration:underline}html pre.shiki code .snCLD, html code.shiki .snCLD{--shiki-default:#000000;--shiki-dark:#F92672}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s0PsH, html code.shiki .s0PsH{--shiki-default:#098658;--shiki-dark:#AE81FF}html pre.shiki code .s4J9F, html code.shiki .s4J9F{--shiki-default:#0000FF;--shiki-default-font-style:inherit;--shiki-dark:#66D9EF;--shiki-dark-font-style:italic}html pre.shiki code .sMc8R, html code.shiki .sMc8R{--shiki-default:#0000FF;--shiki-dark:#AE81FF}",{"title":363,"searchDepth":580,"depth":580,"links":581},2,[],{"issue":583,"comments":587},{"number":584,"title":585,"html_url":586},98,"[Comment] NWebSec ASP.NET MVC Security Through HTTP Headers","https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98",[588,600,608,616,624,632,640],{"id":589,"html_url":590,"body_html":591,"created_at":592,"updated_at":592,"author_association":593,"user":594,"reactions":598},627269225,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98#issuecomment-627269225","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Ff2abf8af10853779a252fd137f58808d82534e29bd550ae5fb098eb39a5f47d3\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f33653736626234353361353535663436353435363865626539656364376531363f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Biagio Paruolo\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Ff2abf8af10853779a252fd137f58808d82534e29bd550ae5fb098eb39a5f47d3\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f33653736626234353361353535663436353435363865626539656364376531363f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"http:\u002F\u002Ftwitter.com\u002FRedConsultingIT\">Biagio Paruolo\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2015-05-21 07:27:26\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>.NET 4.5.x support CORS out of the box.\u003C\u002Fp>","2020-05-12T10:57:33Z","OWNER",{"login":595,"avatar_url":596,"html_url":597},"RehanSaeed","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F2270364?v=4","https:\u002F\u002Fgithub.com\u002FRehanSaeed",{"url":599,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627269225\u002Freactions",{"id":601,"html_url":602,"body_html":603,"created_at":604,"updated_at":604,"author_association":593,"user":605,"reactions":606},627269267,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98#issuecomment-627269267","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F1bd828e572832133938e41f62ea05c7d0654a2ecd0b5a0a81e130b80c556fa36\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f36336332336162343732666364346165346430353861613663643165363961383f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Anna\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F1bd828e572832133938e41f62ea05c7d0654a2ecd0b5a0a81e130b80c556fa36\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f36336332336162343732666364346165346430353861613663643165363961383f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"http:\u002F\u002Fontimesheet.com\u002F\">Anna\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2016-03-20 19:20:15\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Your documentation and the template refers to ASP 4.5 runtime - this in itself is a big security issue, since Microsoft has upgraded to 4.6.1 and stopped support including security notices against 4.5.2 and before.\u003C\u002Fp>\n\u003Cp>So please update the target versions and the runtime versions.\u003C\u002Fp>","2020-05-12T10:57:40Z",{"login":595,"avatar_url":596,"html_url":597},{"url":607,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627269267\u002Freactions",{"id":609,"html_url":610,"body_html":611,"created_at":612,"updated_at":612,"author_association":593,"user":613,"reactions":614},627269316,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98#issuecomment-627269316","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Muhammad Rehan Saeed\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\u002F\u002Frehansaeed.com\u002F\">Muhammad Rehan Saeed\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2016-03-21 10:13:22\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>Your documentation and the template refers to ASP 4.5 runtime - this in itself is a big security issue, since Microsoft has upgraded to 4.6.1 and stopped support including security notices against 4.5.2 and before.\u003C\u002Fp>\n\u003Cp>So please update the target versions and the runtime versions.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>I guess you are referring to \u003Ccode>httpruntime\u003C\u002Fcode> \u003Ccode>targetframework\u003C\u002Fcode> in \u003Ccode>Web.config\u003C\u002Fcode>. The ASP.NET 4.6 MVC 5 template currently supports .NET 4.5.1 to support VS 2012 users. I guess it's time to upgrade to .NET 4.5.2. I've checked in a change and you'll see the update out shortly. Users can always upgrade themselves in the project properties.\u003C\u002Fp>","2020-05-12T10:57:47Z",{"login":595,"avatar_url":596,"html_url":597},{"url":615,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627269316\u002Freactions",{"id":617,"html_url":618,"body_html":619,"created_at":620,"updated_at":620,"author_association":593,"user":621,"reactions":622},627269364,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98#issuecomment-627269364","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F0d04c5c8f01b8a0756fba9cbb368820374db8a81b87e47fb43d26901bc5be8f5\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f30306434323237376233356162346666653339663537303831653334306661323f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Val\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F0d04c5c8f01b8a0756fba9cbb368820374db8a81b87e47fb43d26901bc5be8f5\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f30306434323237376233356162346666653339663537303831653334306661323f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Val\u003C\u002Fstrong> commented on \u003Cstrong>2016-10-18 16:03:05\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Hi Rehan, Great article thanks!\u003C\u002Fp>\n\u003Cp>I think you have a typo in \u003Ccode>X-Frame-Options\u003C\u002Fcode> definition, it should be vice versa:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>SameOrigin\u003C\u002Fcode> - Specifies that the \u003Ccode>X-Frame-Options\u003C\u002Fcode> header should be set in the HTTP response, instructing the browser to display the page when it is loaded in an iframe - but only if the iframe is from the same origin as the page.\u003C\u002Fli>\n\u003Cli>\u003Ccode>Deny\u003C\u002Fcode> - Specifies that the \u003Ccode>X-Frame-Options\u003C\u002Fcode> header should be set in the HTTP response, instructing the browser to not display the page when it is loaded in an iframe.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Thanks\u003C\u002Fp>","2020-05-12T10:57:53Z",{"login":595,"avatar_url":596,"html_url":597},{"url":623,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627269364\u002Freactions",{"id":625,"html_url":626,"body_html":627,"created_at":628,"updated_at":628,"author_association":593,"user":629,"reactions":630},627269420,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98#issuecomment-627269420","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Muhammad Rehan Saeed\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\u002F\u002Frehansaeed.com\u002F\">Muhammad Rehan Saeed\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2016-11-04 09:48:49\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>Hi Rehan, Great article thanks!\u003C\u002Fp>\n\u003Cp>I think you have a typo in \u003Ccode>X-Frame-Options\u003C\u002Fcode> definition, it should be vice versa:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>SameOrigin\u003C\u002Fcode> - Specifies that the \u003Ccode>X-Frame-Options\u003C\u002Fcode> header should be set in the HTTP response, instructing the browser to display the page when it is loaded in an iframe - but only if the iframe is from the same origin as the page.\u003C\u002Fli>\n\u003Cli>\u003Ccode>Deny\u003C\u002Fcode> - Specifies that the \u003Ccode>X-Frame-Options\u003C\u002Fcode> header should be set in the HTTP response, instructing the browser to not display the page when it is loaded in an iframe.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Thanks\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Thanks, fixed!\u003C\u002Fp>","2020-05-12T10:58:01Z",{"login":595,"avatar_url":596,"html_url":597},{"url":631,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627269420\u002Freactions",{"id":633,"html_url":634,"body_html":635,"created_at":636,"updated_at":636,"author_association":593,"user":637,"reactions":638},627269470,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98#issuecomment-627269470","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Ffaebda231e93e758429f65119f50f895195d3677f1494841345618f131fe167e\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f35633762323462623466303063656464393865633430313533663733333562373f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Rich\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Ffaebda231e93e758429f65119f50f895195d3677f1494841345618f131fe167e\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f35633762323462623466303063656464393865633430313533663733333562373f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Rich\u003C\u002Fstrong> commented on \u003Cstrong>2018-09-06 16:44:10\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Can you explain what the advantages of this are over just adding the headers to the \u003Ccode>customheaders\u003C\u002Fcode> section of the web.config file.\u003C\u002Fp>","2020-05-12T10:58:08Z",{"login":595,"avatar_url":596,"html_url":597},{"url":639,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627269470\u002Freactions",{"id":641,"html_url":642,"body_html":643,"created_at":644,"updated_at":644,"author_association":593,"user":645,"reactions":646},627269520,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F98#issuecomment-627269520","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Muhammad Rehan Saeed\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\u002F\u002Frehansaeed.com\u002F\">Muhammad Rehan Saeed\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2018-09-21 09:47:04\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>Can you explain what the advantages of this are over just adding the headers to the \u003Ccode>customheaders\u003C\u002Fcode> section of the web.config file.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>It's dynamic, so you can provide different headers for each page. Also, if you use ASP.NET Core, then NWebSec is the only way to go.\u003C\u002Fp>","2020-05-12T10:58:15Z",{"login":595,"avatar_url":596,"html_url":597},{"url":647,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627269520\u002Freactions","2015-02-05T00:00:00+00:00",null,"The NWebSec NuGet packages help secure your ASP.NET MVC site using HTTP headers. The ASP.NET Core Boilerplate project template configures them our of the box.","md",[653,655,656,657,658,659,660,661,662],{"depth":654,"value":158},1,{"depth":654,"value":216},{"depth":654,"value":248},{"depth":580,"value":305},{"depth":580,"value":382},{"depth":580,"value":443},{"depth":580,"value":467},{"depth":580,"value":487},{"depth":654,"value":548},"\u002Fimages\u002Fhero\u002FNWebSec-1366x768.png",{},true,"posts\u002F2015\u002Fnwebsec-asp-net-mvc-security-through-http-headers\u002Findex",[668,669,56,670,500,671,672,134,673,248],".NET","ASP.NET MVC","C#","Content Security Policy","CSP","HTTP",6,[676,680,684,689,694,697,700,704,708,712,715,719,724,727,730,734,738,742,745,749,753,757,760,763,766,770,773,775,778,779,781,784,787,789,792,796,799,803,807,811,815,819,823,827,830,834,838,842,846,849,853,857,860,863,867,871,876,880,884,888,892,896,900,903,906,909,913,917,920,924,927,930,933,936,940,944,947,950,954,958,961,964,967,971,975,979,983,986,989,994,997,1000,1004,1007,1011,1015,1018,1022,1025,1028,1032,1036,1040],{"title":677,"permalink":678,"heroImage":679,"timeToRead":654},"Just Start - The First Blog Post","\u002Fjust-start-the-first-blog-post\u002F","\u002Fimages\u002Fhero\u002FJust-Start-1366x768.png",{"title":681,"permalink":682,"heroImage":683,"timeToRead":580},"ConfigureAwait in Task Parallel Library (TPL)","\u002Fconfigureawait-task-parallel-library\u002F","\u002Fimages\u002Fhero\u002FMicrosoft-.NET-1366x768.png",{"title":685,"permalink":686,"heroImage":687,"timeToRead":688},"Stop The Brace Wars, Use StyleCop","\u002Fstop-brace-wars-use-stylecop\u002F","\u002Fimages\u002Fhero\u002FStyleCop-1366x768.png",3,{"title":690,"permalink":691,"heroImage":692,"timeToRead":693},"Reactive Extensions (Rx) - Part 1 - Replacing C# Events","\u002Freactive-extensions-part1-replacing-events\u002F","\u002Fimages\u002Fhero\u002FReactive-Extensions-1366x768.png",4,{"title":695,"permalink":696,"heroImage":692,"timeToRead":688},"Reactive Extensions (Rx) - Part 2 - Wrapping C# Events","\u002Freactive-extensions-part2-wrapping-events\u002F",{"title":698,"permalink":699,"heroImage":692,"timeToRead":580},"Reactive Extensions (Rx) - Part 3 - Naming Conventions","\u002Freactive-extensions-part3-naming-conventions\u002F",{"title":701,"permalink":702,"heroImage":703,"timeToRead":688},"WPF Metro Part 1 - Modern UI for WPF","\u002Fwpf-metro-part1-modern-ui-for-wpf\u002F","\u002Fimages\u002Fhero\u002FModern-UI-for-WPF-1366x768.png",{"title":705,"permalink":706,"heroImage":707,"timeToRead":688},"WPF Metro Part 2 - MahApps Metro","\u002Fwpf-metro-part2-mahapps-metro\u002F","\u002Fimages\u002Fhero\u002FMahApps-Metro-1366x768.png",{"title":709,"permalink":710,"heroImage":711,"timeToRead":688},"Windows 8.1 TouchScreen Gaming Laptops","\u002Fwindows-8-touchscreen-gaming-laptops\u002F","\u002Fimages\u002Fhero\u002FFry-Shutup-And-Take-My-Money-1366x768.png",{"title":713,"permalink":714,"heroImage":692,"timeToRead":688},"Reactive Extensions (Rx) - Part 4 - Replacing Timers","\u002Freactive-extensions-part4-replacing-timers\u002F",{"title":716,"permalink":717,"heroImage":718,"timeToRead":580},"WPF Metro Part 3 - Elysium","\u002Fwpf-metro-part3-elysium\u002F","\u002Fimages\u002Fhero\u002FElysium-1366x768.png",{"title":720,"permalink":721,"heroImage":722,"timeToRead":723},"WPF Metro Part 4 - Elysium Extra","\u002Fwpf-metro-part4-elysium-extra\u002F","\u002Fimages\u002Fhero\u002FElysium-Extra-1366x768.png",8,{"title":725,"permalink":726,"heroImage":692,"timeToRead":693},"Reactive Extensions (Rx) - Part 5 - Awaiting Observables","\u002Freactive-extensions-part5-awaiting-observables\u002F",{"title":728,"permalink":729,"heroImage":683,"timeToRead":723},"GetHashCode Made Easy","\u002Fgethashcode-made-easy\u002F",{"title":731,"permalink":732,"heroImage":692,"timeToRead":733},"Reactive Extensions (Rx) - Part 6 - Task ToObservable","\u002Freactive-extensions-part6-task-toobservable\u002F",5,{"title":735,"permalink":736,"heroImage":737,"timeToRead":654},"Portable Class Library (PCL) version of NotificationsExtensions NuGet package","\u002Fportable-class-library-version-of-notificationsextensions-nuget-package\u002F","\u002Fimages\u002Fhero\u002FNuGet-1366x768.png",{"title":739,"permalink":740,"heroImage":741,"timeToRead":733},"Model-View-ViewModel (MVVM) - Part 1 - Overview","\u002Fmodel-view-viewmodel-mvvm-part1-overview\u002F","\u002Fimages\u002Fhero\u002FMVVM-1366x768.png",{"title":743,"permalink":744,"heroImage":741,"timeToRead":693},"Model-View-ViewModel (MVVM) - Part 2 - IDisposable","\u002Fmodel-view-viewmodel-mvvm-part2-idisposable\u002F",{"title":746,"permalink":747,"heroImage":741,"timeToRead":748},"Model-View-ViewModel (MVVM) - Part 3 - INotifyPropertyChanged","\u002Fmodel-view-viewmodel-mvvm-part3-inotifypropertychanged\u002F",11,{"title":750,"permalink":751,"heroImage":752,"timeToRead":688},"Naming Conventions","\u002Fnaming-conventions\u002F","\u002Fimages\u002Fhero\u002FNaming-Conventions-1366x768.png",{"title":754,"permalink":755,"heroImage":741,"timeToRead":756},"Model-View-ViewModel (MVVM) - Part 4 - INotifyDataErrorInfo","\u002Fmodel-view-viewmodel-mvvm-part4-inotifydataerrorinfo\u002F",12,{"title":758,"permalink":759,"heroImage":722,"timeToRead":693},"Elysium Extra 1.1 Released","\u002Felysium-extra-1-1-released\u002F",{"title":56,"permalink":55,"heroImage":761,"timeToRead":762},"\u002Fimages\u002Fhero\u002FASP.NET-Core-Boilerplate-1366x768.png",7,{"title":106,"permalink":105,"heroImage":764,"timeToRead":765},"\u002Fimages\u002Fhero\u002FFavicons-1366x768.png",17,{"title":767,"permalink":768,"heroImage":769,"timeToRead":762},"Custom Visual Studio Project Templates","\u002Fcustom-visual-studio-project-templates\u002F","\u002Fimages\u002Fhero\u002FVisual-Studio-1366x768.png",{"title":771,"permalink":772,"heroImage":769,"timeToRead":688},"Configuration File Transforms In Visual Studio Should Be Built In","\u002Fconfiguration-file-transforms-in-visual-studio-should-be-built-in\u002F",{"title":774,"permalink":69,"heroImage":761,"timeToRead":748},"Securing the ASP.NET MVC Web.config",{"title":776,"permalink":777,"heroImage":692,"timeToRead":580},"Reactive Extensions (Rx) - Part 7 - Sample Events","\u002Freactive-extensions-part7-sample-events\u002F",{"title":41,"permalink":75,"heroImage":663,"timeToRead":674},{"title":81,"permalink":80,"heroImage":780,"timeToRead":151},"\u002Fimages\u002Fhero\u002FContent-Security-Policy-CSP-for-ASP.NET-MVC-1366x768.png",{"title":782,"permalink":783,"heroImage":683,"timeToRead":733},"C# 6.0 - Saving Developers From Themselves","\u002Fc-6-0-saving-developers-from-themselves\u002F",{"title":112,"permalink":111,"heroImage":785,"timeToRead":786},"\u002Fimages\u002Fhero\u002FRSS-And-Atom-1366x768.png",19,{"title":94,"permalink":93,"heroImage":788,"timeToRead":748},"\u002Fimages\u002Fhero\u002FLink-Juice-1366x768.png",{"title":100,"permalink":790,"heroImage":791,"timeToRead":693},"\u002Fdynamically-generating-robots-txt-using-asp-net-mvc\u002F","\u002Fimages\u002Fhero\u002FRobots.txt-1366x768.jpg",{"title":793,"permalink":794,"heroImage":795,"timeToRead":693},"Minifying HTML for ASP.NET MVC","\u002Fminifying-html-for-asp-net-mvc\u002F","\u002Fimages\u002Fhero\u002FThe-Internet-Is-A-Series-Of-Tubes-1366x768.jpg",{"title":797,"permalink":798,"heroImage":761,"timeToRead":580},"Whats New in ASP.NET Core Boilerplate","\u002Fwhats-new-in-asp-net-5-mvc-6-boilerplate\u002F",{"title":800,"permalink":801,"heroImage":802,"timeToRead":762},"Dynamically Generating Sitemap.xml for ASP.NET MVC","\u002Fdynamically-generating-sitemap-xml-for-asp-net-mvc\u002F","\u002Fimages\u002Fhero\u002FSitemaps-1366x768.png",{"title":804,"permalink":805,"heroImage":806,"timeToRead":580},"So I've Been Awarded Microsoft MVP Status!","\u002Fso-ive-been-awarded-microsoft-mvp-status\u002F","\u002Fimages\u002Fhero\u002FMicrosoft-MVP-1366x768.png",{"title":808,"permalink":809,"heroImage":810,"timeToRead":654},".NET Big-O Algorithm Complexity Cheat Sheet","\u002Fnet-big-o-algorithm-complexity-cheat-sheet\u002F","\u002Fimages\u002Fhero\u002FNET-Big-O-Algorithm-Complexity-Cheat-Sheet-1366x768.jpg",{"title":812,"permalink":813,"heroImage":814,"timeToRead":688},"Logging with Serilog.Exceptions","\u002Flogging-with-serilog-exceptions\u002F","\u002Fimages\u002Fhero\u002FSerilog.Exceptions-1366x768.png",{"title":816,"permalink":817,"heroImage":818,"timeToRead":654},"Make Certificate","\u002Fmake-certificate\u002F","\u002Fimages\u002Fhero\u002FMake-Certificate-1366x768.png",{"title":820,"permalink":821,"heroImage":822,"timeToRead":580},"Colorful.Console","\u002Fcolorful-console\u002F","\u002Fimages\u002Fhero\u002FColorful.Console-1366x768.png",{"title":824,"permalink":825,"heroImage":826,"timeToRead":688},"Subresource Integrity TagHelper Using ASP.NET Core - Part 1","\u002Fsubresource-integrity-taghelper-using-asp-net-core\u002F","\u002Fimages\u002Fhero\u002FMake-Security-Easy-1366x768.png",{"title":828,"permalink":829,"heroImage":826,"timeToRead":693},"Subresource Integrity TagHelper Using ASP.NET Core - Part 2","\u002Fsubresource-integrity-taghelper-using-asp-net-core-part-2\u002F",{"title":831,"permalink":832,"heroImage":833,"timeToRead":733},"Social TagHelpers for ASP.NET Core","\u002Fsocial-taghelpers-for-asp-net-core\u002F","\u002Fimages\u002Fhero\u002FSocial-Media-1366x768.png",{"title":835,"permalink":836,"heroImage":837,"timeToRead":674},"Azure Active Directory Versus Identity Server","\u002Fazure-active-directory-versus-identity-server\u002F","\u002Fimages\u002Fhero\u002FAzure-Active-Directory-Versus-Identity-Server-1366x768.png",{"title":839,"permalink":840,"heroImage":841,"timeToRead":580},"ASP.NET Core Fluent Interface Extensions","\u002Fasp-net-core-fluent-interface-extensions\u002F","\u002Fimages\u002Fhero\u002FFluent-Interface-All-The-Things-1366x768.png",{"title":843,"permalink":844,"heroImage":845,"timeToRead":748},"NGINX for ASP.NET Core In-Depth","\u002Fnginx-asp-net-core-depth\u002F","\u002Fimages\u002Fhero\u002FNGINX-1366x768.png",{"title":847,"permalink":848,"heroImage":683,"timeToRead":580},"The Dotnet Watch Tool","\u002Fthe-dotnet-watch-tool\u002F",{"title":850,"permalink":851,"heroImage":852,"timeToRead":693},"Making Application Insights Fast & Secure","\u002Fmaking-application-insights-fast-and-secure\u002F","\u002Fimages\u002Fhero\u002FApplication-Insights-1366x768.png",{"title":854,"permalink":855,"heroImage":856,"timeToRead":762},"SEO Friendly URL's for ASP.NET Core","\u002Fseo-friendly-urls-asp-net-core\u002F","\u002Fimages\u002Fhero\u002FSearch-Engine-Optimization-SEO-1366x768.png",{"title":858,"permalink":859,"heroImage":692,"timeToRead":654},"Reactive Extensions (Rx) - Part 8 - Timeouts","\u002Freactive-extensions-rx-part-8-timeouts\u002F",{"title":861,"permalink":862,"heroImage":683,"timeToRead":693},"Custom Project Templates Using dotnet new","\u002Fcustom-project-templates-using-dotnet-new\u002F",{"title":864,"permalink":865,"heroImage":866,"timeToRead":723},"Cross-Platform DevOps for .NET Core","\u002Fcross-platform-devops-net-core\u002F","\u002Fimages\u002Fhero\u002FDotnet-Cake-AppVeyor-Travis-1366x768.png",{"title":868,"permalink":869,"heroImage":870,"timeToRead":762},"Cleaning Up CSPROJ","\u002Fcleaning-up-csproj\u002F","\u002Fimages\u002Fhero\u002FCleaning-Up-CSPROJ-1366x768.png",{"title":872,"permalink":873,"heroImage":874,"timeToRead":875},"dotnet new Feature Selection","\u002Fdotnet-new-feature-selection\u002F","\u002Fimages\u002Fhero\u002FWho-Wants-To-Be-A-Millionaire-1366x768.png",9,{"title":877,"permalink":878,"heroImage":879,"timeToRead":693},"ASP.NET Core Lazy Command Pattern","\u002Fasp-net-core-lazy-command-pattern\u002F","\u002Fimages\u002Fhero\u002FASP.NET-Core-Lazy-Command-Pattern-1366x768.png",{"title":881,"permalink":882,"heroImage":883,"timeToRead":580},"Structured Data using Schema.NET","\u002Fstructured-data-using-schema-net\u002F","\u002Fimages\u002Fhero\u002FSchema.NET-1366x768.png",{"title":885,"permalink":886,"heroImage":887,"timeToRead":674},"Keeping Up With Software Development","\u002Fkeeping-software-development\u002F","\u002Fimages\u002Fhero\u002FKeeping-up-with-Software-Development-1366x768.png",{"title":889,"permalink":890,"heroImage":891,"timeToRead":580},"A Very Generic .editorconfig File (Updated)","\u002Fgeneric-editorconfig-file\u002F","\u002Fimages\u002Fhero\u002FA-Very-Generic-Editorconfig-File-1366x768.png",{"title":893,"permalink":894,"heroImage":895,"timeToRead":733},"ASP.NET Core Caching in Practice","\u002Fasp-net-core-caching-in-practice\u002F","\u002Fimages\u002Fhero\u002FASP.NET-Core-Caching-in-Practice-1366x768.png",{"title":897,"permalink":898,"heroImage":899,"timeToRead":654},"Docker Read-Only File Systems","\u002Fdocker-read-file-systems\u002F","\u002Fimages\u002Fhero\u002FDocker-1366x768.png",{"title":901,"permalink":902,"heroImage":899,"timeToRead":688},"Docker Labels in Depth","\u002Fdocker-labels-depth\u002F",{"title":904,"permalink":905,"heroImage":899,"timeToRead":693},"Useful Docker Images - Part 1","\u002Fuseful-docker-images-part1\u002F",{"title":907,"permalink":908,"heroImage":899,"timeToRead":733},"Useful Docker Images - Part 2","\u002Fuseful-docker-images-part2\u002F",{"title":910,"permalink":911,"heroImage":912,"timeToRead":693},"Writing your Webpack configuration in TypeScript","\u002Fwriting-your-webpack-configuration-in-typescript\u002F","\u002Fimages\u002Fhero\u002FTypeScript-1366x768.png",{"title":914,"permalink":915,"heroImage":916,"timeToRead":733},"Writing Code while Asleep","\u002Fwriting-code-asleep\u002F","\u002Fimages\u002Fhero\u002FWhile-Alive-Eat-Sleep-Code-Repeat-1366x768.png",{"title":918,"permalink":919,"heroImage":683,"timeToRead":580},"The Dotnet Watch Tool Revisited","\u002Fthe-dotnet-watch-tool-revisited\u002F",{"title":921,"permalink":922,"heroImage":923,"timeToRead":580},".NET Boxed","\u002Fnet-boxed\u002F","\u002Fimages\u002Fhero\u002FDotnet-Boxed-1366x768.png",{"title":925,"permalink":926,"heroImage":683,"timeToRead":580},"Migrating to Entity Framework Core Seed Data","\u002Fmigrating-to-entity-framework-core-seed-data\u002F",{"title":928,"permalink":929,"heroImage":683,"timeToRead":688},"Optimally Configuring Entity Framework Core","\u002Foptimally-configuring-entity-framework-core\u002F",{"title":931,"permalink":932,"heroImage":683,"timeToRead":654},"ASP.NET Core Hidden Gem - QueryHelpers","\u002Fasp-net-core-hidden-gem-queryhelpers\u002F",{"title":934,"permalink":935,"heroImage":683,"timeToRead":875},"Optimally Configuring ASP.NET Core HttpClientFactory","\u002Foptimally-configuring-asp-net-core-httpclientfactory\u002F",{"title":937,"permalink":938,"heroImage":939,"timeToRead":762},"PluralSight vs LinkedIn Learning vs FrontendMasters vs Egghead.io vs YouTube","\u002Fpluralsight-vs-linkedin-learning-vs-frontendmasters-vs-egghead-io-vs-youtube\u002F","\u002Fimages\u002Fhero\u002FOnline-Learning-1366x768.png",{"title":941,"permalink":942,"heroImage":943,"timeToRead":875},"Is ASP.NET Core now a Mature Platform?","\u002Fis-asp-net-core-now-a-mature-platform\u002F","\u002Fimages\u002Fhero\u002FRocket-1366x768.jpg",{"title":945,"permalink":946,"heroImage":923,"timeToRead":875},"A Simple and Fast Object Mapper","\u002Fa-simple-and-fast-object-mapper\u002F",{"title":948,"permalink":949,"heroImage":899,"timeToRead":654},"Securing ASP.NET Core in Docker","\u002Fsecuring-asp-net-core-in-docker\u002F",{"title":951,"permalink":952,"heroImage":953,"timeToRead":693},"Git Cloning the Windows OS Repo","\u002Fgit-cloning-the-windows-os-repo\u002F","\u002Fimages\u002Fhero\u002FWindows-1366x768.png",{"title":955,"permalink":956,"heroImage":957,"timeToRead":762},".gitattributes Best Practices","\u002Fgitattributes-best-practices\u002F","\u002Fimages\u002Fhero\u002FGit-1366x768.png",{"title":959,"permalink":960,"heroImage":683,"timeToRead":688},"Unit Testing dotnet new Templates","\u002Funit-testing-dotnet-new-templates\u002F",{"title":962,"permalink":963,"heroImage":923,"timeToRead":733},"What dotnet new Could Be","\u002Fwhat-dotnet-new-could-be\u002F",{"title":965,"permalink":966,"heroImage":683,"timeToRead":693},"ASP.NET Core Integration Testing & Mocking using Moq","\u002Fasp-net-core-integration-testing-mocking-using-moq\u002F",{"title":968,"permalink":969,"heroImage":970,"timeToRead":762},"Choosing a Static Site Generator","\u002Fchoosing-a-static-site-generator\u002F","\u002Fimages\u002Fhero\u002FStatic-Site-Generators-1600x900.png",{"title":972,"permalink":973,"heroImage":974,"timeToRead":580},"Spicing up your Browser Console","\u002Fspicing-up-your-browser-console\u002F","\u002Fimages\u002Fhero\u002FFiglet-Fonts-1600x900.png",{"title":976,"permalink":977,"heroImage":978,"timeToRead":733},"Racism in Software Development & Beyond","\u002Fracism-in-software-development-and-beyond\u002F","\u002Fimages\u002Fhero\u002FBlack-Glowing-Fist-1600x900.png",{"title":980,"permalink":981,"heroImage":982,"timeToRead":733},"The Easiest Way to Version NuGet Packages","\u002Fthe-easiest-way-to-version-nuget-packages\u002F","\u002Fimages\u002Fhero\u002FSemantic-Versioning-1600x900.png",{"title":984,"permalink":985,"heroImage":737,"timeToRead":674},"The Fastest NuGet Package Ever Published (Probably)","\u002Fthe-fastest-nuget-package-ever-published-probably\u002F",{"title":987,"permalink":988,"heroImage":683,"timeToRead":688},"Automating .NET Security Updates","\u002Fautomating-dotnet-security-updates\u002F",{"title":990,"permalink":991,"heroImage":992,"timeToRead":993},"Deep Dive into Open Telemetry for .NET","\u002Fdeep-dive-into-open-telemetry-for-net\u002F","\u002Fimages\u002Fhero\u002FOpen-Telemetry-1600x900.png",10,{"title":995,"permalink":996,"heroImage":992,"timeToRead":688},"Open Telemetry for ASP.NET Core","\u002Fopen-telemetry-for-asp-net-core\u002F",{"title":998,"permalink":999,"heroImage":992,"timeToRead":688},"Exporting Open Telemetry Data to Jaeger","\u002Fexporting-open-telemetry-data-to-jaeger\u002F",{"title":1001,"permalink":1002,"heroImage":1003,"timeToRead":688},"A System for Grouping & Sorting CSS Properties","\u002Fsystem-for-grouping-and-sorting-css-properties\u002F","\u002Fimages\u002Fhero\u002FCSS-1600x900.png",{"title":1005,"permalink":1006,"heroImage":1003,"timeToRead":674},"CSS General Rules of Thumb","\u002Fcss-general-rules-of-thumb\u002F",{"title":1008,"permalink":1009,"heroImage":1010,"timeToRead":693},"Web Component Custom Element Gotchas","\u002Fweb-component-custom-element-gotchas\u002F","\u002Fimages\u002Fhero\u002FWeb-Components-1600x900.png",{"title":1012,"permalink":1013,"heroImage":1014,"timeToRead":580},"Code Coverage & Frontend Testing","\u002Fcode-coverage-and-frontend-testing\u002F","\u002Fimages\u002Fhero\u002FJest-Cypress-1600x900.png",{"title":1016,"permalink":1017,"heroImage":769,"timeToRead":654},".NET Boxed Visual Studio Integration","\u002Fdotnet-boxed-visual-studio-integration\u002F",{"title":1019,"permalink":1020,"heroImage":1021,"timeToRead":688},"The Windows Package Manager","\u002Fwindows-package-manager\u002F","\u002Fimages\u002Fhero\u002FWinget-1600x900.png",{"title":1023,"permalink":1024,"heroImage":683,"timeToRead":688},"The Problem with C# 10 Implicit Usings","\u002Fthe-problem-with-csharp-10-implicit-usings\u002F",{"title":1026,"permalink":1027,"heroImage":992,"timeToRead":693},"Optimally Configuring Open Telemetry Tracing for ASP.NET Core","\u002Foptimally-configuring-open-telemetry-tracing-for-asp-net-core\u002F",{"title":1029,"permalink":1030,"heroImage":1031,"timeToRead":580},"Live Streaming .NET","\u002Flive-streaming-dotnet\u002F","\u002Fimages\u002Fhero\u002FMy-YouTube-1920x1080.jpg",{"title":1033,"permalink":1034,"heroImage":1035,"timeToRead":580},"I Was Awarded as an Open UK Honouree","\u002Fopen-uk-honouree\u002F","\u002Fimages\u002Fhero\u002FOpen-UK-Honours-1366x768.jpg",{"title":1037,"permalink":1038,"heroImage":1039,"timeToRead":693},"On the Etiquette of Pull Request Comments","\u002Fon-the-etiquette-of-pull-request-comments\u002F","\u002Fimages\u002Fhero\u002FPrecious-PR-1600x900.jpg",{"title":1041,"permalink":1042,"heroImage":1043,"timeToRead":654},"AI Gone Rogue","\u002Fai-gone-rogue\u002F","\u002Fimages\u002Fhero\u002FHAL-9000-Prop-1600x900.png",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1045},"\u003Cpath fill=\"currentColor\" d=\"M352 320c-22.608 0-43.387 7.819-59.79 20.895l-102.486-64.054a96.55 96.55 0 0 0 0-41.683l102.486-64.054C308.613 184.181 329.392 192 352 192c53.019 0 96-42.981 96-96S405.019 0 352 0s-96 42.981-96 96c0 7.158.79 14.13 2.276 20.841L155.79 180.895C139.387 167.819 118.608 160 96 160c-53.019 0-96 42.981-96 96s42.981 96 96 96c22.608 0 43.387-7.819 59.79-20.895l102.486 64.054A96.3 96.3 0 0 0 256 416c0 53.019 42.981 96 96 96s96-42.981 96-96s-42.981-96-96-96\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1047},"\u003Cpath fill=\"currentColor\" d=\"M504 256C504 119 393 8 256 8S8 119 8 256c0 123.78 90.69 226.38 209.25 245V327.69h-63V256h63v-54.64c0-62.15 37-96.48 93.67-96.48c27.14 0 55.52 4.84 55.52 4.84v61h-31.28c-30.8 0-40.41 19.12-40.41 38.73V256h68.78l-11 71.69h-57.78V501C413.31 482.38 504 379.78 504 256\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1049},"\u003Cpath fill=\"currentColor\" d=\"M459.37 151.716c.325 4.548.325 9.097.325 13.645c0 138.72-105.583 298.558-298.558 298.558c-59.452 0-114.68-17.219-161.137-47.106c8.447.974 16.568 1.299 25.34 1.299c49.055 0 94.213-16.568 130.274-44.832c-46.132-.975-84.792-31.188-98.112-72.772c6.498.974 12.995 1.624 19.818 1.624c9.421 0 18.843-1.3 27.614-3.573c-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319c-28.264-18.843-46.781-51.005-46.781-87.391c0-19.492 5.197-37.36 14.294-52.954c51.655 63.675 129.3 105.258 216.365 109.807c-1.624-7.797-2.599-15.918-2.599-24.04c0-57.828 46.782-104.934 104.934-104.934c30.213 0 57.502 12.67 76.67 33.137c23.715-4.548 46.456-13.32 66.599-25.34c-7.798 24.366-24.366 44.833-46.132 57.827c21.117-2.273 41.584-8.122 60.426-16.243c-14.292 20.791-32.161 39.308-52.628 54.253\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1051},"\u003Cpath fill=\"currentColor\" d=\"M201.5 305.5c-13.8 0-24.9-11.1-24.9-24.6c0-13.8 11.1-24.9 24.9-24.9c13.6 0 24.6 11.1 24.6 24.9c0 13.6-11.1 24.6-24.6 24.6M504 256c0 137-111 248-248 248S8 393 8 256S119 8 256 8s248 111 248 248m-132.3-41.2c-9.4 0-17.7 3.9-23.8 10c-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3l55.4 12.5c0 13.6 11.1 24.6 24.6 24.6c13.8 0 24.9-11.3 24.9-24.9s-11.1-24.9-24.9-24.9c-9.7 0-18 5.8-22.1 13.8l-61.2-13.6c-3-.8-6.1 1.4-6.9 4.4l-19.1 86.4c-33.2 1.4-63.1 11.3-85.5 26.8c-6.1-6.4-14.7-10.2-24.1-10.2c-34.9 0-46.3 46.9-14.4 62.8c-1.1 5-1.7 10.2-1.7 15.5c0 52.6 59.2 95.2 132 95.2c73.1 0 132.3-42.6 132.3-95.2c0-5.3-.6-10.8-1.9-15.8c31.3-16 19.8-62.5-14.9-62.5M302.8 331c-18.2 18.2-76.1 17.9-93.6 0c-2.2-2.2-6.1-2.2-8.3 0c-2.5 2.5-2.5 6.4 0 8.6c22.8 22.8 87.3 22.8 110.2 0c2.5-2.2 2.5-6.1 0-8.6c-2.2-2.2-6.1-2.2-8.3 0m7.7-75c-13.6 0-24.6 11.1-24.6 24.9c0 13.6 11.1 24.6 24.6 24.6c13.8 0 24.9-11.1 24.9-24.6c0-13.8-11-24.9-24.9-24.9\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1053},"\u003Cpath fill=\"currentColor\" d=\"M512 194.8c0 101.3-82.4 183.8-183.8 183.8c-101.7 0-184.4-82.4-184.4-183.8c0-101.6 82.7-184.3 184.4-184.3C429.6 10.5 512 93.2 512 194.8M0 501.5h90v-491H0z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":1055},"\u003Cpath fill=\"currentColor\" d=\"m20.216 6.415l-.132-.666c-.119-.598-.388-1.163-1.001-1.379c-.197-.069-.42-.098-.57-.241c-.152-.143-.196-.366-.231-.572c-.065-.378-.125-.756-.192-1.133c-.057-.325-.102-.69-.25-.987c-.195-.4-.597-.634-.996-.788a6 6 0 0 0-.626-.194c-1-.263-2.05-.36-3.077-.416a26 26 0 0 0-3.7.062c-.915.083-1.88.184-2.75.5c-.318.116-.646.256-.888.501c-.297.302-.393.77-.177 1.146c.154.267.415.456.692.58c.36.162.737.284 1.123.366c1.075.238 2.189.331 3.287.37q1.829.074 3.65-.118q.449-.05.896-.119c.352-.054.578-.513.474-.834c-.124-.383-.457-.531-.834-.473c-.466.074-.96.108-1.382.146q-1.767.12-3.536.006a22 22 0 0 1-1.157-.107c-.086-.01-.18-.025-.258-.036q-.364-.055-.724-.13c-.111-.027-.111-.185 0-.212h.005q.416-.09.838-.147h.002c.131-.009.263-.032.394-.048a25 25 0 0 1 3.426-.12q1.011.029 2.017.144l.228.031q.4.06.798.145c.392.085.895.113 1.07.542c.055.137.08.288.111.431l.319 1.484a.237.237 0 0 1-.199.284h-.003l-.112.015a37 37 0 0 1-4.743.295a37 37 0 0 1-4.699-.304c-.14-.017-.293-.042-.417-.06c-.326-.048-.649-.108-.973-.161c-.393-.065-.768-.032-1.123.161c-.29.16-.527.404-.675.701c-.154.316-.199.66-.267 1c-.069.34-.176.707-.135 1.056c.087.753.613 1.365 1.37 1.502a39.7 39.7 0 0 0 11.343.376a.483.483 0 0 1 .535.53l-.071.697l-1.018 9.907c-.041.41-.047.832-.125 1.237c-.122.637-.553 1.028-1.182 1.171q-.868.197-1.756.205c-.656.004-1.31-.025-1.966-.022c-.699.004-1.556-.06-2.095-.58c-.475-.458-.54-1.174-.605-1.793l-.731-7.013l-.322-3.094c-.037-.351-.286-.695-.678-.678c-.336.015-.718.3-.678.679l.228 2.185l.949 9.112c.147 1.344 1.174 2.068 2.446 2.272c.742.12 1.503.144 2.257.156c.966.016 1.942.053 2.892-.122c1.408-.258 2.465-1.198 2.616-2.657l1.024-9.995l.215-2.087a.48.48 0 0 1 .39-.426c.402-.078.787-.212 1.074-.518c.455-.488.546-1.124.385-1.766zm-1.478.772c-.145.137-.363.201-.578.233c-2.416.359-4.866.54-7.308.46c-1.748-.06-3.477-.254-5.207-.498c-.17-.024-.353-.055-.47-.18c-.22-.236-.111-.71-.054-.995c.052-.26.152-.609.463-.646c.484-.057 1.046.148 1.526.22q.865.132 1.737.212c2.48.226 5.002.19 7.472-.14q.675-.09 1.345-.21c.399-.072.84-.206 1.08.206c.166.281.188.657.162.974a.54.54 0 0 1-.169.364zm-6.159 3.9c-.862.37-1.84.788-3.109.788a6 6 0 0 1-1.569-.217l.877 9.004c.065.78.717 1.38 1.5 1.38c0 0 1.243.065 1.658.065c.447 0 1.786-.065 1.786-.065c.783 0 1.434-.6 1.499-1.38l.94-9.95a4 4 0 0 0-1.322-.238c-.826 0-1.491.284-2.26.613\"\u002F>",{"left":4,"top":4,"width":29,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1057},"\u003Cpath fill=\"currentColor\" d=\"M111.4 295.9c-3.5 19.2-17.4 108.7-21.5 134c-.3 1.8-1 2.5-3 2.5H12.3c-7.6 0-13.1-6.6-12.1-13.9L58.8 46.6c1.5-9.6 10.1-16.9 20-16.9c152.3 0 165.1-3.7 204 11.4c60.1 23.3 65.6 79.5 44 140.3c-21.5 62.6-72.5 89.5-140.1 90.3c-43.4.7-69.5-7-75.3 24.2M357.1 152c-1.8-1.3-2.5-1.8-3 1.3c-2 11.4-5.1 22.5-8.8 33.6c-39.9 113.8-150.5 103.9-204.5 103.9c-6.1 0-10.1 3.3-10.9 9.4c-22.6 140.4-27.1 169.7-27.1 169.7c-1 7.1 3.5 12.9 10.6 12.9h63.5c8.6 0 15.7-6.3 17.4-14.9c.7-5.4-1.1 6.1 14.4-91.3c4.6-22 14.3-19.7 29.3-19.7c71 0 126.4-28.8 142.9-112.3c6.5-34.8 4.6-71.4-23.8-92.6\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1059},"\u003Cpath fill=\"currentColor\" d=\"M256 8C119.043 8 8 119.083 8 256c0 136.997 111.043 248 248 248s248-111.003 248-248C504 119.083 392.957 8 256 8m0 448c-110.532 0-200-89.431-200-200c0-110.495 89.472-200 200-200c110.491 0 200 89.471 200 200c0 110.53-89.431 200-200 200m107.244-255.2c0 67.052-72.421 68.084-72.421 92.863V300c0 6.627-5.373 12-12 12h-45.647c-6.627 0-12-5.373-12-12v-8.659c0-35.745 27.1-50.034 47.579-61.516c17.561-9.845 28.324-16.541 28.324-29.579c0-17.246-21.999-28.693-39.784-28.693c-23.189 0-33.894 10.977-48.942 29.969c-4.057 5.12-11.46 6.071-16.666 2.124l-27.824-21.098c-5.107-3.872-6.251-11.066-2.644-16.363C184.846 131.491 214.94 112 261.794 112c49.071 0 101.45 38.304 101.45 88.8M298 368c0 23.159-18.841 42-42 42s-42-18.841-42-42s18.841-42 42-42s42 18.841 42 42\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":1061},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M19 12H5m7 7l-7-7l7-7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":1063},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",1793198150755]