ricardo/BCards
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'Release/ajustes-headers' (#23) from Release/ajustes-headers into main
All checks were successful
BCards Deployment Pipeline / Run Tests (push) Successful in 3s
Details
BCards Deployment Pipeline / PR Validation (push) Has been skipped
Details
BCards Deployment Pipeline / Build and Push Image (push) Successful in 11m3s
Details
BCards Deployment Pipeline / Deploy to Release Swarm (ARM) (push) Has been skipped
Details
BCards Deployment Pipeline / Deploy to Production (ARM - OCI) (push) Successful in 1m8s
Details
BCards Deployment Pipeline / Cleanup Old Resources (push) Has been skipped
Details
BCards Deployment Pipeline / Deployment Summary (push) Successful in 0s
Details

Browse Source 
Reviewed-on: https://git.carneiro.ddnsfree.com/ricardo/BCards/pulls/23
This commit is contained in:
ricardo 2026-01-06 00:38:46 +00:00
commit 7c0d91c68e
1 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/BCards.Web/Program.cs
View File

@ -581,7 +581,10 @@ builder.Services.AddHsts(options =>
var app = builder.Build();
app.UseForwardedHeaders();
app.UseForwardedHeaders(new ForwardedHeadersOptions
{
ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
});
if (!app.Environment.IsDevelopment())
{
@ -607,6 +610,19 @@ app.Use(async (context, next) =>
context.Response.Headers.Append("Referrer-Policy", "no-referrer");
context.Response.Headers.Append("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
// Content Security Policy - Protects against XSS attacks
var csp = "default-src 'self'; " +
"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://code.jquery.com https://cdn.jsdelivr.net/npm/bootstrap@5.3.2 https://accounts.google.com https://apis.google.com; " +
"style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com https://cdn.jsdelivr.net/npm/bootstrap@5.3.2; " +
"img-src 'self' data: https: blob:; " +
"font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net; " +
"connect-src 'self' https://accounts.google.com https://apis.google.com https://login.microsoftonline.com; " +
"frame-src 'self' https://accounts.google.com https://login.microsoftonline.com; " +
"object-src 'none'; " +
"base-uri 'self'; " +
"form-action 'self'";
context.Response.Headers.Append("Content-Security-Policy", csp);
// Load balancer e debugging headers
context.Response.Headers.Append("X-Server-ID", Environment.MachineName);
context.Response.Headers.Append("X-Instance-ID", $"{Environment.MachineName}-{Environment.ProcessId}");