Benutzer:MovGP0/ASP.NET Core/HSTS

HTTP Strict Transport Security (HSTS)

Before the browser is redirected to HTTPS, a Men In The Middle attack is possible
HSTS prevents the browser to use HTTP again for a given time.
HSTS does not redirect but prevent access. use chrome://net-internals/#hsts to manage HSTS in Chrome.

Method 1: SSL mit RequireHttps Attribute

set "Enable SSL" in `Project Settings` ↦ `Debug` ↦ `Web Server Settings`

[RequireHttps]
public sealed class MyController : Controller
{
    // ...
}

Method 2: SSL mit RequireHttps Attribute

set "Enable SSL" in `Project Settings` ↦ `Debug` ↦ `Web Server Settings`

Startup.cs

public sealed class Startup
{
    private IHostingEnvironment HostingEnvironment { get; }

    public Startup(IHostingEnvironment hostingEnvironment)
    {
        HostingEnvironment = hostingEnvironment;
    }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvc();

        if(!HostingEnvironment.IsDevelopment())
        {
            services.Configure<MvcOptions>(o => o.Filters.Add(new RequireHttpsAttribute()));
        }
        
        // ...
    }
}

Method 3: HSTS with NWebsec

NuGet: NWebsec.AspNetCore.Middleware

Startup.cs

if (!env.IsDevelopment())
{
    app.UseHsts(h => h.MaxAge(days: 356));
}

Method 3: SSL und HSTS with SecurityHeaders

NuGet: Joonasw.AspNetCore.SecurityHeaders

Startup.cs

if (!env.IsDevelopment())
{
    app.UseHttpsEnforcement();
    app.UseHsts(new HstsOptions
    {
        Seconds = (int)Timespan.FromDays(30).TotalSeconds,
        IncludeSubDomains = false,
        Preload = false
    });
}

Quellen

Joonas Westlin: HTTP Strict Transport Security (HSTS) in ASP.NET Core. 22. Januar 2017, abgerufen am 12. Mai 2017 (englisch).

|}