mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2025-01-18 21:32:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

X-XSS-Protection

Browse Source
This commit is contained in:
nicolas.dorier 2018-07-12 02:23:54 +09:00
parent a256dd3277
commit 5dd57c8064
4 changed files with 34 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
BTCPayServer/Filters/XContentTypeOptionsAttribute.cs
View File

@ -19,11 +19,11 @@ namespace BTCPayServer.Filters
public string Value { get; set; }
public void OnActionExecuting(ActionExecutingContext context)
{
var existing = context.HttpContext.Response.Headers["x-content-type-options"].FirstOrDefault();
var existing = context.HttpContext.Response.Headers["X-Content-Type-Options"].FirstOrDefault();
if (existing != null && Value == null)
context.HttpContext.Response.Headers.Remove("x-content-type-options");
context.HttpContext.Response.Headers.Remove("X-Content-Type-Options");
else
context.HttpContext.Response.Headers["x-content-type-options"] = Value;
context.HttpContext.Response.Headers["X-Content-Type-Options"] = Value;
}
}
}

6
BTCPayServer/Filters/XFrameOptionsAttribute.cs
View File

@ -23,11 +23,11 @@ namespace BTCPayServer.Filters
public void OnActionExecuting(ActionExecutingContext context)
{
var existing = context.HttpContext.Response.Headers["x-frame-options"].FirstOrDefault();
var existing = context.HttpContext.Response.Headers["X-Frame-Options"].FirstOrDefault();
if (existing != null && Value == null)
context.HttpContext.Response.Headers.Remove("x-frame-options");
context.HttpContext.Response.Headers.Remove("X-Frame-Options");
else
context.HttpContext.Response.Headers["x-frame-options"] = Value;
context.HttpContext.Response.Headers["X-Frame-Options"] = Value;
}
}
}

27
BTCPayServer/Filters/XXSSProtectionAttribute.cs Normal file
View File

@ -0,0 +1,27 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.AspNetCore.Mvc.ViewFeatures;
using Microsoft.AspNetCore.Mvc.ViewFeatures.Internal;
namespace BTCPayServer.Filters
{
public class XXSSProtectionAttribute : Attribute, IActionFilter
{
public void OnActionExecuted(ActionExecutedContext context)
{
}
public void OnActionExecuting(ActionExecutingContext context)
{
var existing = context.HttpContext.Response.Headers["X-XSS-Protection"].FirstOrDefault();
if (existing != null)
context.HttpContext.Response.Headers.Remove("X-XSS-Protection");
else
context.HttpContext.Response.Headers["X-XSS-Protection"] = "1; mode=block";
}
}
}

1
BTCPayServer/Hosting/Startup.cs
View File

@ -80,6 +80,7 @@ namespace BTCPayServer.Hosting
{
o.Filters.Add(new XFrameOptionsAttribute("DENY"));
o.Filters.Add(new XContentTypeOptionsAttribute("nosniff"));
o.Filters.Add(new XXSSProtectionAttribute());
});
services.Configure<IdentityOptions>(options =>