Enhancing Security in ASP.NET Core APIs with Content Security Policy (CSP)

Content Security Policy (CSP) is a security feature that helps mitigate the risk of cross-site scripting (XSS), clickjacking, and other code injection attacks. It allows you to specify the sources of content that browsers should consider trusted, effectively reducing the attack surface of your application. CSP works by adding a Content-Security-Policy header to your HTTP response, which instructs the browser to enforce the specified policy.

For example, a CSP can restrict your application to load scripts, styles, and other resources only from specific, trusted origins. This means that even if an attacker manages to inject malicious code into your application, the browser will block its execution if it violates the defined policy.

To add Content Security Policy (CSP) using the NetEscapades.AspNetCore.SecurityHeaders NuGet package in your ASP.NET Core API, follow these steps:

1- Install the NuGet Package:

First, you need to install the NetEscapades.AspNetCore.SecurityHeaders package.

2- Configure CSP in Your Application:

Next, you need to configure the CSP in your Startup.cs file.

using NetEscapades.AspNetCore.SecurityHeaders;
using NetEscapades.AspNetCore.SecurityHeaders.Headers;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddControllers();

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}
else
{
    app.UseExceptionHandler("/Home/Error");
    app.UseHsts();
}

// Configure CSP
var policyCollection = new HeaderPolicyCollection()
    .AddContentSecurityPolicy(builder =>
    {
        builder.AddDefaultSrc().Self();
        builder.AddScriptSrc().Self().From("https://trustedscripts.example.com");
        builder.AddStyleSrc().Self().From("https://trustedstyles.example.com");
        builder.AddImgSrc().Self().Data();
        builder.AddConnectSrc().Self();
        builder.AddFontSrc().Self();
        builder.AddObjectSrc().None();
        builder.AddFormAction().Self();
        builder.AddFrameAncestors().None();
        builder.AddBaseUri().Self();
        builder.AddFrameSrc().Self();
    });

app.UseSecurityHeaders(policyCollection);

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

app.UseAuthorization();

app.MapControllers();

app.Run();

3- Detailed CSP Configuration:

You can customize the CSP policy further according to your needs. Here are some common directives you might want to include:

default-src: Specifies the default policy for loading content such as JavaScript, Images, CSS, Fonts, AJAX requests, Frames, HTML5 Media.
script-src: Defines valid sources for JavaScript.
style-src: **Defines valid sources for stylesheets.
**connect-src: Defines valid sources for AJAX, WebSocket connections.
font-src: Defines valid sources for fonts.
object-src: Defines valid sources for plugins like Flash.
form-action: Defines valid endpoints for submission from tags.

Customize the policy to fit the requirements of your application.

4- Verify CSP:

After configuring CSP, ensure that it’s working correctly. You can do this by inspecting the HTTP response headers in your browser’s developer tools. Look for the Content-Security-Policy header and verify its value.

Conclusion:

In this article, we explored the importance of CSP, the benefits of using the NetEscapades.AspNetCore.SecurityHeaders package, and provided a step-by-step guide to implement CSP in your .NET 8.0 ASP.NET Core API. By following these guidelines, you can ensure that your application is well-protected against common vulnerabilities, providing a safer experience for your users.