diff --git a/GenderPayGap.Core/Extensions/AspNetCore/Extensions.cs b/GenderPayGap.Core/Extensions/AspNetCore/Extensions.cs
index 5c6e8b3c8..8ee570ea7 100644
--- a/GenderPayGap.Core/Extensions/AspNetCore/Extensions.cs
+++ b/GenderPayGap.Core/Extensions/AspNetCore/Extensions.cs
@@ -1,52 +1,11 @@
-using System;
using System.Threading;
using GenderPayGap.Core;
-using Microsoft.AspNetCore.Http;
namespace GenderPayGap.Extensions.AspNetCore
{
- public static partial class Extensions
+ public static class Extensions
{
- ///
- /// Removes null header or ensures header is set to correct value
- /// ///
- ///
- /// The HttpContext to remove the header from
- /// The key of the header name
- /// The value which the header should be - if empty removed the header
- public static void SetResponseHeader(this HttpContext context, string key, string value = null)
- {
- try
- {
- if (string.IsNullOrWhiteSpace(value))
- {
- if (context.Response.Headers.ContainsKey(key))
- {
- context.Response.Headers.Remove(key);
- }
- }
- else if (!context.Response.Headers.ContainsKey(key))
- {
- context.Response.Headers.Add(key, value);
- }
- else if (context.Response.Headers[key] != value)
- {
- context.Response.Headers.Remove(key); //This is required as cannot change a key once added
- context.Response.Headers[key] = value;
- }
- }
- catch (Exception ex)
- {
- if (context.Response.Headers.ContainsKey(key))
- {
- throw new Exception($"Could not set header '{key}' from value '{context.Response.Headers[key]}' to '{value}' ", ex);
- }
-
- throw new Exception($"Could not add header '{key}' to value '{value}' ", ex);
- }
- }
-
public static string GetThreadCount()
{
ThreadPool.GetMinThreads(out int workerMin, out int ioMin);
diff --git a/GenderPayGap.Core/Extensions/AspNetCore/SecurityHeaderMiddleware.cs b/GenderPayGap.Core/Extensions/AspNetCore/SecurityHeaderMiddleware.cs
index fc569977b..e18cb4f29 100644
--- a/GenderPayGap.Core/Extensions/AspNetCore/SecurityHeaderMiddleware.cs
+++ b/GenderPayGap.Core/Extensions/AspNetCore/SecurityHeaderMiddleware.cs
@@ -19,9 +19,22 @@ public async Task Invoke(HttpContext httpContext)
{
httpContext.Response.OnStarting(
() => {
- foreach (KeyValuePair securityHeader in Global.SecurityHeaders)
+ foreach (KeyValuePair securityHeader in Global.SecurityHeadersToAdd)
{
- httpContext.SetResponseHeader(securityHeader.Key, securityHeader.Value);
+ if (!httpContext.Response.Headers.ContainsKey(securityHeader.Key))
+ {
+ httpContext.Response.Headers.Add(securityHeader.Key, securityHeader.Value);
+ }
+ else if (httpContext.Response.Headers[securityHeader.Key] != securityHeader.Value)
+ {
+ httpContext.Response.Headers.Remove(securityHeader.Key); // This is required as we cannot change a key once it is added
+ httpContext.Response.Headers[securityHeader.Key] = securityHeader.Value;
+ }
+ }
+
+ foreach (string securityHeaderName in Global.SecurityHeadersToRemove)
+ {
+ httpContext.Response.Headers.Remove(securityHeaderName);
}
return Task.CompletedTask;
diff --git a/GenderPayGap.Core/Global.cs b/GenderPayGap.Core/Global.cs
index c0c91c757..c42154ad5 100644
--- a/GenderPayGap.Core/Global.cs
+++ b/GenderPayGap.Core/Global.cs
@@ -110,7 +110,7 @@ public static bool EnableSubmitAlerts
public static int MaxCompareBasketCount => 500; // Maximum number of employers you can add to the compare basket
public static int EditableReportCount => 4; // Specifies how many reports an employer can edit
public static int EditableScopeCount => 2; // Specifies how many scopes an employer can edit
- public static Dictionary SecurityHeaders =>
+ public static Dictionary SecurityHeadersToAdd =>
new Dictionary
{
{"X-Content-Type-Options", "nosniff"},
@@ -121,11 +121,16 @@ public static bool EnableSubmitAlerts
{"X-Content-Security-Policy", "frame-ancestors 'none'"},
{"Referrer-Policy", "origin-when-cross-origin"},
{"Strict-Transport-Security", "max-age=31536000; includeSubDomains"},
- {"X-Powered-By", ""},
- {"X-AspNet-Version", ""},
- {"X-AspNetMvc-Version", ""},
- {"Server", ""}
};
+ public static List SecurityHeadersToRemove =>
+ new List
+ {
+ "X-Powered-By",
+ "X-AspNet-Version",
+ "X-AspNetMvc-Version",
+ "Server"
+ };
+
public static int ObfuscationSeed => 1045659205;
#endregion