Security Hardening Guide for ASP.NET Core Applications Print

Comprehensive Security Hardening Guide

This guide covers essential security configurations to protect your ASP.NET Core applications on Windows hosting.

1. HTTPS and SSL/TLS Configuration

Force HTTPS Redirect

Always redirect HTTP to HTTPS. Add to web.config:

<system.webServer>
  <rewrite>
    <rules>
      <rule name="HTTPS Redirect" stopProcessing="true">
        <match url="(.*)" />
        <conditions>
          <add input="{HTTPS}" pattern="^OFF$" />
        </conditions>
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                redirectType="Permanent" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

ASP.NET Core HTTPS Enforcement

// In Program.cs
app.UseHttpsRedirection();
app.UseHsts();

2. Security Headers

Essential Security Headers in web.config

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <!-- Prevent clickjacking -->
      <add name="X-Frame-Options" value="SAMEORIGIN" />

      <!-- Prevent MIME type sniffing -->
      <add name="X-Content-Type-Options" value="nosniff" />

      <!-- Enable XSS filter -->
      <add name="X-XSS-Protection" value="1; mode=block" />

      <!-- Referrer policy -->
      <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />

      <!-- Permissions policy -->
      <add name="Permissions-Policy" value="geolocation=(), microphone=(), camera=()" />

      <!-- Remove server identification -->
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

HSTS (HTTP Strict Transport Security)

Forces browsers to use HTTPS for future visits:

<!-- In web.config -->
<add name="Strict-Transport-Security"
     value="max-age=31536000; includeSubDomains; preload" />

Important: Only enable HSTS after confirming HTTPS works perfectly. The preload directive submits your site to browser preload lists.

ASP.NET Core Security Headers

// In Program.cs or Startup.cs
app.Use(async (context, next) =>
{
    context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
    context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
    context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");
    context.Response.Headers.Add("Referrer-Policy", "strict-origin-when-cross-origin");
    await next();
});

3. Content Security Policy (CSP)

Basic CSP Header

<add name="Content-Security-Policy"
     value="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'self';" />

CSP Directives Explained

4. Remove Sensitive Information

Hide Server Version

<system.webServer>
  <security>
    <requestFiltering removeServerHeader="true" />
  </security>
</system.webServer>

<system.web>
  <httpRuntime enableVersionHeader="false" />
</system.web>

Custom Error Pages

<system.webServer>
  <httpErrors errorMode="Custom" existingResponse="Replace">
    <remove statusCode="404" />
    <error statusCode="404" path="/error/404.html" responseMode="File" />
    <remove statusCode="500" />
    <error statusCode="500" path="/error/500.html" responseMode="File" />
  </httpErrors>
</system.webServer>

5. Request Filtering

Block Dangerous File Extensions

<system.webServer>
  <security>
    <requestFiltering>
      <fileExtensions>
        <add fileExtension=".config" allowed="false" />
        <add fileExtension=".cs" allowed="false" />
        <add fileExtension=".csproj" allowed="false" />
        <add fileExtension=".bak" allowed="false" />
        <add fileExtension=".sql" allowed="false" />
      </fileExtensions>
      <hiddenSegments>
        <add segment="bin" />
        <add segment="App_Data" />
      </hiddenSegments>
    </requestFiltering>
  </security>
</system.webServer>

Limit Request Size (Prevent DoS)

<requestFiltering>
  <requestLimits maxAllowedContentLength="30000000" /> <!-- 30MB -->
</requestFiltering>

6. Security Header Verification

Test your security headers using these tools:

• securityheaders.com - Grades your security headers
• ssllabs.com/ssltest - Tests SSL/TLS configuration
• observatory.mozilla.org - Mozilla security scanner

Security Header Quick Reference

Green = Must have, Yellow = Recommended