();
18 | });
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Properties/launchSettings.json:
--------------------------------------------------------------------------------
1 | {
2 | "iisSettings": {
3 | "windowsAuthentication": false,
4 | "anonymousAuthentication": true,
5 | "iisExpress": {
6 | "applicationUrl": "https://localhost:44342/",
7 | "sslPort": 44342
8 | }
9 | },
10 | "profiles": {
11 | "IIS Express": {
12 | "commandName": "IISExpress",
13 | "launchBrowser": true,
14 | "environmentVariables": {
15 | "ASPNETCORE_ENVIRONMENT": "Development"
16 | }
17 | },
18 | "Samples": {
19 | "commandName": "Project",
20 | "launchBrowser": true,
21 | "environmentVariables": {
22 | "ASPNETCORE_ENVIRONMENT": "Development"
23 | },
24 | "applicationUrl": "http://localhost:15491"
25 | }
26 | }
27 | }
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Views/Home/About.cshtml:
--------------------------------------------------------------------------------
1 | @{
2 | ViewData["Title"] = "About";
3 | }
4 | @ViewData["Title"].
5 | @ViewData["Message"]
6 |
7 | Use this area to provide additional information.
8 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Views/Home/Contact.cshtml:
--------------------------------------------------------------------------------
1 | @{
2 | ViewData["Title"] = "Contact";
3 | }
4 | @ViewData["Title"].
5 | @ViewData["Message"]
6 |
7 |
8 | One Microsoft WayP:
11 | 425.555.0100
12 |
13 |
14 |
15 | Support: Support@example.com Marketing: Marketing@example.com
17 |
18 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Views/Shared/ApplicationError.cshtml:
--------------------------------------------------------------------------------
1 |
2 | Error page
3 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Views/Shared/Error.cshtml:
--------------------------------------------------------------------------------
1 | @{
2 | ViewData["Title"] = "Error";
3 | }
4 |
5 | Error.
6 | An error occurred while processing your request.
7 |
8 | Development Mode
9 |
10 | Swapping to Development environment will display more detailed information about the error that occurred.
11 |
12 |
13 | Development environment should not be enabled in deployed applications , as it can result in sensitive information from exceptions being displayed to end users. For local debugging, development environment can be enabled by setting the ASPNETCORE_ENVIRONMENT environment variable to Development , and restarting the application.
14 |
15 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Views/Shared/_Layout.cshtml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | @*@ViewData["Title"] - Sample App
8 |
9 |
10 |
13 |
14 |
19 |
22 |
27 |
30 |
31 |
32 |
52 |
53 | @RenderBody()
54 |
55 |
56 | © 2018 - WebApplication1
57 |
58 |
61 |
62 |
63 |
64 |
65 |
66 |
68 |
69 |
71 |
72 |
73 |
74 |
75 | @RenderSection("scripts", required: false)
76 |
77 |
78 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Views/_ViewImports.cshtml:
--------------------------------------------------------------------------------
1 | @addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
2 | @addTagHelper *, Joonasw.AspNetCore.SecurityHeaders
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/Views/_ViewStart.cshtml:
--------------------------------------------------------------------------------
1 | @{
2 | Layout = "_Layout";
3 | }
4 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/appsettings.json:
--------------------------------------------------------------------------------
1 | {
2 | "Logging": {
3 | "IncludeScopes": false,
4 | "LogLevel": {
5 | "Default": "Debug",
6 | "System": "Information",
7 | "Microsoft": "Information"
8 | }
9 | },
10 | "Hsts": {
11 | "Duration": "30:00:00:00",
12 | "IncludeSubDomains": false,
13 | "Preload": false
14 | },
15 | "Csp": {
16 | "ReportOnly": true,
17 | "ReportUri": "/csp-report",
18 | "UpgradeInsecureRequests": true,
19 | "BlockAllMixedContent": true, //Ignored if UpgradeInsecureRequests is true
20 | "Default": {
21 | "AllowedSources": [
22 | "'none'"
23 | ]
24 | },
25 | "Script": {
26 | "AddNonce": true,
27 | "AllowUnsafeEval": false,
28 | "AllowUnsafeInline": false,
29 | "AllowedSources": [
30 | "'self'",
31 | "localhost:1591",
32 | "localhost:44342",
33 | "ajax.aspnetcdn.com"
34 | ],
35 | "AllowedHashes": [
36 | "sha256-MV3a0caNPWq8CgfaHwRc3OtqWiEXK6Mo0nt+/2nFwV0="
37 | ]
38 | //"StrictDynamic": true
39 | },
40 | "Style": {
41 | "AddNonce": true,
42 | "AllowedSources": [
43 | "'self'",
44 | "ajax.aspnetcdn.com"
45 | ]
46 | },
47 | "Img": {
48 | "AllowedSources": [
49 | "'self'"
50 | ]
51 | },
52 | "Connect": {
53 | "AllowedSources": [
54 | "'self'",
55 | "ws://localhost:1591",
56 | "http://localhost:1591"
57 | ]
58 | },
59 | "Font": {
60 | "AllowedSources": [
61 | "'self'",
62 | "ajax.aspnetcdn.com"
63 | ]
64 | },
65 | "Frame": {
66 | "AllowNone": true
67 | },
68 | "Worker": {
69 | "AllowNone": true
70 | },
71 | "BaseUri": {
72 | "AllowSelf": true
73 | },
74 | "Prefetch": {
75 | "AllowSelf": true
76 | },
77 | "RequireSri": {
78 | "ForScripts": true,
79 | "ForStyles": true
80 | }
81 | },
82 | "FeaturePolicy": {
83 | "Camera": {
84 | "AllowSelf": true
85 | },
86 | "Payment": {
87 | "AllowNone": true
88 | },
89 | "Other": {
90 | "some-new-thing": {
91 | "AllowNone": true
92 | }
93 | }
94 | }
95 | }
96 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/bower.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "asp.net",
3 | "private": true,
4 | "dependencies": {
5 | "bootstrap": "3.3.6",
6 | "jquery": "2.2.0",
7 | "jquery-validation": "1.14.0",
8 | "jquery-validation-unobtrusive": "3.2.6"
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/bundleconfig.json:
--------------------------------------------------------------------------------
1 | // Configure bundling and minification for the project.
2 | // More info at https://go.microsoft.com/fwlink/?LinkId=808241
3 | [
4 | {
5 | "outputFileName": "wwwroot/css/site.min.css",
6 | // An array of relative input file paths. Globbing patterns supported
7 | "inputFiles": [
8 | "wwwroot/css/site.css"
9 | ]
10 | },
11 | {
12 | "outputFileName": "wwwroot/js/site.min.js",
13 | "inputFiles": [
14 | "wwwroot/js/site.js"
15 | ],
16 | // Optionally specify minification options
17 | "minify": {
18 | "enabled": true,
19 | "renameLocals": true
20 | },
21 | // Optinally generate .map file
22 | "sourceMap": false
23 | }
24 | ]
25 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/web.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
6 |
7 |
8 |
10 |
11 |
12 |
15 |
16 |
17 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/wwwroot/_references.js:
--------------------------------------------------------------------------------
1 | /// "
10 | ],
11 | "description": "Form validation made easy",
12 | "main": "dist/jquery.validate.js",
13 | "keywords": [
14 | "forms",
15 | "validation",
16 | "validate"
17 | ],
18 | "license": "MIT",
19 | "ignore": [
20 | "**/.*",
21 | "node_modules",
22 | "bower_components",
23 | "test",
24 | "demo",
25 | "lib"
26 | ],
27 | "dependencies": {
28 | "jquery": ">= 1.7.2"
29 | },
30 | "version": "1.14.0",
31 | "_release": "1.14.0",
32 | "_resolution": {
33 | "type": "version",
34 | "tag": "1.14.0",
35 | "commit": "c1343fb9823392aa9acbe1c3ffd337b8c92fed48"
36 | },
37 | "_source": "git://github.com/jzaefferer/jquery-validation.git",
38 | "_target": ">=1.8",
39 | "_originalSource": "jquery-validation"
40 | }
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/wwwroot/lib/jquery-validation/LICENSE.md:
--------------------------------------------------------------------------------
1 | The MIT License (MIT)
2 | =====================
3 |
4 | Copyright Jörn Zaefferer
5 |
6 | Permission is hereby granted, free of charge, to any person obtaining a copy
7 | of this software and associated documentation files (the "Software"), to deal
8 | in the Software without restriction, including without limitation the rights
9 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 | copies of the Software, and to permit persons to whom the Software is
11 | furnished to do so, subject to the following conditions:
12 |
13 | The above copyright notice and this permission notice shall be included in
14 | all copies or substantial portions of the Software.
15 |
16 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 | THE SOFTWARE.
23 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/wwwroot/lib/jquery/.bower.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "jquery",
3 | "main": "dist/jquery.js",
4 | "license": "MIT",
5 | "ignore": [
6 | "package.json"
7 | ],
8 | "keywords": [
9 | "jquery",
10 | "javascript",
11 | "browser",
12 | "library"
13 | ],
14 | "homepage": "https://github.com/jquery/jquery-dist",
15 | "version": "2.2.0",
16 | "_release": "2.2.0",
17 | "_resolution": {
18 | "type": "version",
19 | "tag": "2.2.0",
20 | "commit": "6fc01e29bdad0964f62ef56d01297039cdcadbe5"
21 | },
22 | "_source": "git://github.com/jquery/jquery-dist.git",
23 | "_target": "2.2.0",
24 | "_originalSource": "jquery"
25 | }
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Samples/wwwroot/lib/jquery/LICENSE.txt:
--------------------------------------------------------------------------------
1 | Copyright jQuery Foundation and other contributors, https://jquery.org/
2 |
3 | This software consists of voluntary contributions made by many
4 | individuals. For exact contribution history, see the revision history
5 | available at https://github.com/jquery/jquery
6 |
7 | The following license applies to all parts of this software except as
8 | documented below:
9 |
10 | ====
11 |
12 | Permission is hereby granted, free of charge, to any person obtaining
13 | a copy of this software and associated documentation files (the
14 | "Software"), to deal in the Software without restriction, including
15 | without limitation the rights to use, copy, modify, merge, publish,
16 | distribute, sublicense, and/or sell copies of the Software, and to
17 | permit persons to whom the Software is furnished to do so, subject to
18 | the following conditions:
19 |
20 | The above copyright notice and this permission notice shall be
21 | included in all copies or substantial portions of the Software.
22 |
23 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
27 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
28 | OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
29 | WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
30 |
31 | ====
32 |
33 | All files located in the node_modules and external directories are
34 | externally maintained libraries used by this software which have their
35 | own licenses; we recommend you read them, as their terms may differ from
36 | the terms above.
37 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/ContentTypeOptionsMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.Text;
4 | using System.Threading.Tasks;
5 | using Joonasw.AspNetCore.SecurityHeaders.XContentTypeOptions;
6 | using Microsoft.AspNetCore.Http;
7 | using Microsoft.Extensions.Options;
8 | using Xunit;
9 |
10 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
11 | {
12 | public class ContentTypeOptionsMiddlewareTests
13 | {
14 | [Fact]
15 | public async Task HeaderSetCorrectlyWithNoSniffing()
16 | {
17 | string headerValue = null;
18 | RequestDelegate mockNext = (HttpContext ctx) =>
19 | {
20 | headerValue = ctx.Response.Headers["X-Content-Type-Options"];
21 | return Task.CompletedTask;
22 | };
23 | var options = Options.Create(new XContentTypeOptionsOptions
24 | {
25 | AllowSniffing = false
26 | });
27 | var mockContext = new DefaultHttpContext();
28 | var sut = new XContentTypeOptionsMiddleware(mockNext, options);
29 |
30 | await sut.Invoke(mockContext);
31 |
32 | Assert.Equal("nosniff", headerValue);
33 | }
34 | }
35 | }
36 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/CspRequireSriBuilderTests.cs:
--------------------------------------------------------------------------------
1 | using Joonasw.AspNetCore.SecurityHeaders.Csp.Builder;
2 | using Xunit;
3 |
4 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
5 | {
6 | public class CspRequireSriBuilderTests
7 | {
8 | [Fact]
9 | public void NoOptions_DoesNotGenerateHeader()
10 | {
11 | var builder = new CspRequireSriBuilder();
12 |
13 | var options = builder.BuildOptions();
14 |
15 | Assert.True(string.IsNullOrWhiteSpace(options.ToString()));
16 | }
17 |
18 | [Fact]
19 | public void RequireScript_GeneratesHeader()
20 | {
21 | var builder = new CspRequireSriBuilder();
22 | builder.ForScripts();
23 |
24 | var options = builder.BuildOptions();
25 |
26 | Assert.Equal("require-sri-for script", options.ToString());
27 | }
28 |
29 | [Fact]
30 | public void RequireStyle_GeneratesHeader()
31 | {
32 | var builder = new CspRequireSriBuilder();
33 | builder.ForStyles();
34 |
35 | var options = builder.BuildOptions();
36 |
37 | Assert.Equal("require-sri-for style", options.ToString());
38 | }
39 |
40 | [Fact]
41 | public void RequireScriptAndStyle_GeneratesHeader()
42 | {
43 | var builder = new CspRequireSriBuilder();
44 | builder.ForScripts();
45 | builder.ForStyles();
46 |
47 | var options = builder.BuildOptions();
48 |
49 | Assert.Equal("require-sri-for script style", options.ToString());
50 | }
51 | }
52 | }
53 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/CspSandboxBuilderTests.cs:
--------------------------------------------------------------------------------
1 | using Joonasw.AspNetCore.SecurityHeaders.Csp.Builder;
2 | using Joonasw.AspNetCore.SecurityHeaders.Csp.Options;
3 | using Xunit;
4 |
5 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
6 | {
7 | public class CspSandboxBuilderTests
8 | {
9 | [Fact]
10 | public void AllowForms_SetsAllowFormsToTrue()
11 | {
12 | var builder = new CspSandboxBuilder();
13 |
14 | builder.AllowForms();
15 | CspSandboxOptions options = builder.BuildOptions();
16 |
17 | Assert.True(options.AllowForms);
18 | }
19 |
20 | [Fact]
21 | public void AllowModals_SetsAllowModalsToTrue()
22 | {
23 | var builder = new CspSandboxBuilder();
24 |
25 | builder.AllowModals();
26 | CspSandboxOptions options = builder.BuildOptions();
27 |
28 | Assert.True(options.AllowModals);
29 | }
30 |
31 | [Fact]
32 | public void AllowOrientationLock_SetsAllowOrientationLockToTrue()
33 | {
34 | var builder = new CspSandboxBuilder();
35 |
36 | builder.AllowOrientationLock();
37 | CspSandboxOptions options = builder.BuildOptions();
38 |
39 | Assert.True(options.AllowOrientationLock);
40 | }
41 |
42 | [Fact]
43 | public void AllowPointerLock_SetsAllowPointerLockToTrue()
44 | {
45 | var builder = new CspSandboxBuilder();
46 |
47 | builder.AllowPointerLock();
48 | CspSandboxOptions options = builder.BuildOptions();
49 |
50 | Assert.True(options.AllowPointerLock);
51 | }
52 |
53 | [Fact]
54 | public void AllowPopups_SetsAllowPopupsToTrue()
55 | {
56 | var builder = new CspSandboxBuilder();
57 |
58 | builder.AllowPopups();
59 | CspSandboxOptions options = builder.BuildOptions();
60 |
61 | Assert.True(options.AllowPopups);
62 | }
63 |
64 | [Fact]
65 | public void AllowPopupsToEscapeSandbox_SetsAllowPopupsToEscapeSandboxToTrue()
66 | {
67 | var builder = new CspSandboxBuilder();
68 |
69 | builder.AllowPopupsToEscapeSandbox();
70 | CspSandboxOptions options = builder.BuildOptions();
71 |
72 | Assert.True(options.AllowPopupsToEscapeSandbox);
73 | }
74 |
75 | [Fact]
76 | public void AllowPresentation_SetsAllowPresentationToTrue()
77 | {
78 | var builder = new CspSandboxBuilder();
79 |
80 | builder.AllowPresentation();
81 | CspSandboxOptions options = builder.BuildOptions();
82 |
83 | Assert.True(options.AllowPresentation);
84 | }
85 |
86 | [Fact]
87 | public void AllowSameOrigin_SetsAllowSameOriginToTrue()
88 | {
89 | var builder = new CspSandboxBuilder();
90 |
91 | builder.AllowSameOrigin();
92 | CspSandboxOptions options = builder.BuildOptions();
93 |
94 | Assert.True(options.AllowSameOrigin);
95 | }
96 |
97 | [Fact]
98 | public void AllowScripts_SetsAllowScriptsToTrue()
99 | {
100 | var builder = new CspSandboxBuilder();
101 |
102 | builder.AllowScripts();
103 | CspSandboxOptions options = builder.BuildOptions();
104 |
105 | Assert.True(options.AllowScripts);
106 | }
107 |
108 | [Fact]
109 | public void AllowTopNavigation_SetsAllowTopNavigationToTrue()
110 | {
111 | var builder = new CspSandboxBuilder();
112 |
113 | builder.AllowTopNavigation();
114 | CspSandboxOptions options = builder.BuildOptions();
115 |
116 | Assert.True(options.AllowTopNavigation);
117 | }
118 | }
119 | }
120 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/CspStylesBuilderTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Linq;
3 | using Joonasw.AspNetCore.SecurityHeaders.Csp.Builder;
4 | using Joonasw.AspNetCore.SecurityHeaders.Csp.Options;
5 | using Xunit;
6 |
7 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
8 | {
9 | public class CspStylesBuilderTests
10 | {
11 | [Fact]
12 | public void FromNowhere_SetsAllowNoneToTrue()
13 | {
14 | var builder = new CspStylesBuilder();
15 |
16 | builder.FromNowhere();
17 | CspStyleSrcOptions options = builder.BuildOptions();
18 |
19 | Assert.True(options.AllowNone);
20 | }
21 |
22 | [Fact]
23 | public void FromSelf_SetsAllowSelfToTrue()
24 | {
25 | var builder = new CspStylesBuilder();
26 |
27 | builder.FromSelf();
28 | CspStyleSrcOptions options = builder.BuildOptions();
29 |
30 | Assert.True(options.AllowSelf);
31 | }
32 |
33 | [Fact]
34 | public void From_AddsUrlToAllowedSources()
35 | {
36 | var builder = new CspStylesBuilder();
37 |
38 | builder.From("www.google.com");
39 | CspStyleSrcOptions options = builder.BuildOptions();
40 |
41 | Assert.Equal("www.google.com", options.AllowedSources.Single());
42 | }
43 |
44 | [Fact]
45 | public void From_ThrowsArgumentNullException_WithNullUrl()
46 | {
47 | var builder = new CspStylesBuilder();
48 |
49 | Assert.Throws(() => builder.From(null));
50 | }
51 |
52 | [Fact]
53 | public void From_ThrowsArgumentException_WithEmptyUrl()
54 | {
55 | var builder = new CspStylesBuilder();
56 |
57 | Assert.Throws(() => builder.From(string.Empty));
58 | }
59 |
60 | [Fact]
61 | public void WithHash_AddsHashToAllowedHashes()
62 | {
63 | var builder = new CspStylesBuilder();
64 |
65 | builder.WithHash("sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=");
66 | CspStyleSrcOptions options = builder.BuildOptions();
67 |
68 | Assert.Equal("sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=", options.AllowedHashes.Single());
69 | }
70 |
71 | [Fact]
72 | public void WithHash_ThrowsArgumentNullException_WithNullUrl()
73 | {
74 | var builder = new CspStylesBuilder();
75 |
76 | Assert.Throws(() => builder.WithHash(null));
77 | }
78 |
79 | [Fact]
80 | public void WithHash_ThrowsArgumentException_WithEmptyUrl()
81 | {
82 | var builder = new CspStylesBuilder();
83 |
84 | Assert.Throws(() => builder.WithHash(string.Empty));
85 | }
86 |
87 | [Fact]
88 | public void AllowUnsafeInline_SetsUnsafeInlineToTrue()
89 | {
90 | var builder = new CspStylesBuilder();
91 |
92 | builder.AllowUnsafeInline();
93 | CspStyleSrcOptions options = builder.BuildOptions();
94 |
95 | Assert.True(options.AllowUnsafeInline);
96 | }
97 |
98 | [Fact]
99 | public void AddNonce_SetsAddNonceToTrue()
100 | {
101 | var builder = new CspStylesBuilder();
102 |
103 | builder.AddNonce();
104 | CspStyleSrcOptions options = builder.BuildOptions();
105 |
106 | Assert.True(options.AddNonce);
107 | }
108 |
109 | [Fact]
110 | public void FromAnywhere_SetsAllowAnyToTrue()
111 | {
112 | var builder = new CspStylesBuilder();
113 |
114 | builder.FromAnywhere();
115 | CspStyleSrcOptions options = builder.BuildOptions();
116 |
117 | Assert.True(options.AllowAny);
118 | }
119 |
120 | [Fact]
121 | public void OnlyOverHttps_SetsAllowOnlyHttpsToTrue()
122 | {
123 | var builder = new CspStylesBuilder();
124 |
125 | builder.OnlyOverHttps();
126 | CspStyleSrcOptions options = builder.BuildOptions();
127 |
128 | Assert.True(options.AllowOnlyHttps);
129 | }
130 | }
131 | }
132 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/CspWorkerBuilderTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Linq;
3 | using Joonasw.AspNetCore.SecurityHeaders.Csp.Builder;
4 | using Joonasw.AspNetCore.SecurityHeaders.Csp.Options;
5 | using Xunit;
6 |
7 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
8 | {
9 | public class CspWorkerBuilderTests
10 | {
11 | [Fact]
12 | public void FromNowhere_SetsAllowNoneToTrue()
13 | {
14 | var builder = new CspWorkerBuilder();
15 |
16 | builder.FromNowhere();
17 | CspWorkerSrcOptions options = builder.BuildOptions();
18 |
19 | Assert.True(options.AllowNone);
20 | }
21 |
22 | [Fact]
23 | public void FromSelf_SetsAllowSelfToTrue()
24 | {
25 | var builder = new CspWorkerBuilder();
26 |
27 | builder.FromSelf();
28 | CspWorkerSrcOptions options = builder.BuildOptions();
29 |
30 | Assert.True(options.AllowSelf);
31 | }
32 |
33 | [Fact]
34 | public void FromSelf_ReturnsCorrectString()
35 | {
36 | var builder = new CspWorkerBuilder();
37 |
38 | builder.FromSelf();
39 | CspWorkerSrcOptions options = builder.BuildOptions();
40 |
41 | Assert.Equal("worker-src 'self'", options.ToString(null));
42 | }
43 |
44 | [Fact]
45 | public void From_AddsUrlToAllowedSources()
46 | {
47 | var builder = new CspWorkerBuilder();
48 |
49 | builder.From("www.google.com");
50 | CspWorkerSrcOptions options = builder.BuildOptions();
51 |
52 | Assert.Equal("www.google.com", options.AllowedSources.Single());
53 | }
54 |
55 | [Fact]
56 | public void From_ThrowsArgumentNullException_WithNullUrl()
57 | {
58 | var builder = new CspWorkerBuilder();
59 |
60 | Assert.Throws(() => builder.From(null));
61 | }
62 |
63 | [Fact]
64 | public void From_ThrowsArgumentException_WithEmptyUrl()
65 | {
66 | var builder = new CspWorkerBuilder();
67 |
68 | Assert.Throws(() => builder.From(string.Empty));
69 | }
70 |
71 | [Fact]
72 | public void FromAnywhere_SetsAllowAnyToTrue()
73 | {
74 | var builder = new CspWorkerBuilder();
75 |
76 | builder.FromAnywhere();
77 | CspWorkerSrcOptions options = builder.BuildOptions();
78 |
79 | Assert.True(options.AllowAny);
80 | }
81 |
82 | [Fact]
83 | public void OnlyOverHttps_SetsAllowOnlyHttpsToTrue()
84 | {
85 | var builder = new CspWorkerBuilder();
86 |
87 | builder.OnlyOverHttps();
88 | CspWorkerSrcOptions options = builder.BuildOptions();
89 |
90 | Assert.True(options.AllowOnlyHttps);
91 | }
92 | }
93 | }
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/ExpectCtMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Threading.Tasks;
3 | using Joonasw.AspNetCore.SecurityHeaders.ExpectCT;
4 | using Microsoft.AspNetCore.Http;
5 | using Microsoft.Extensions.Options;
6 | using Xunit;
7 |
8 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
9 | {
10 | public class ExpectCtMiddlewareTests
11 | {
12 | [Fact]
13 | public async Task SetsHeaderCorrectlyWithoutEnforce()
14 | {
15 | string headerValue = null;
16 | RequestDelegate mockNext = (HttpContext ctx) =>
17 | {
18 | headerValue = ctx.Response.Headers["Expect-CT"];
19 | return Task.CompletedTask;
20 | };
21 | var options = Options.Create(new ExpectCTOptions
22 | {
23 | Enforce = false,
24 | ReportUri = "https://reporting.com/report",
25 | MaxAge = TimeSpan.FromHours(1)
26 | });
27 | var mockContext = new DefaultHttpContext();
28 | mockContext.Request.Scheme = "https";
29 | var sut = new ExpectCTMiddleware(mockNext, options);
30 |
31 | await sut.Invoke(mockContext);
32 |
33 | Assert.Equal("max-age=3600, report-uri=\"https://reporting.com/report\"", headerValue);
34 | }
35 |
36 | [Fact]
37 | public async Task SetsHeaderCorrectlyWithEnforce()
38 | {
39 | string headerValue = null;
40 | RequestDelegate mockNext = (HttpContext ctx) =>
41 | {
42 | headerValue = ctx.Response.Headers["Expect-CT"];
43 | return Task.CompletedTask;
44 | };
45 | var options = Options.Create(new ExpectCTOptions
46 | {
47 | Enforce = true,
48 | ReportUri = "https://reporting.com/report",
49 | MaxAge = TimeSpan.FromHours(1)
50 | });
51 | var mockContext = new DefaultHttpContext();
52 | mockContext.Request.Scheme = "https";
53 | var sut = new ExpectCTMiddleware(mockNext, options);
54 |
55 | await sut.Invoke(mockContext);
56 |
57 | Assert.Equal("max-age=3600, enforce, report-uri=\"https://reporting.com/report\"", headerValue);
58 | }
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/FeaturePolicyBuilderTests.cs:
--------------------------------------------------------------------------------
1 | using Joonasw.AspNetCore.SecurityHeaders.FeaturePolicy.Builder;
2 | using Xunit;
3 |
4 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
5 | {
6 | public class FeaturePolicyBuilderTests
7 | {
8 | [Fact]
9 | public void PaymentFromNowhere_SetsValue()
10 | {
11 | var builder = new FeaturePolicyBuilder();
12 |
13 | builder.AllowPayment.FromNowhere();
14 | var options = builder.BuildFeaturePolicyOptions();
15 | string headerValue = options.ToString();
16 |
17 | Assert.Equal("payment 'none'", headerValue);
18 | }
19 |
20 | [Fact]
21 | public void PaymentFromSelfAndGoogle_SetsValue()
22 | {
23 | var builder = new FeaturePolicyBuilder();
24 |
25 | builder.AllowPayment.FromSelf().From("https://www.google.com");
26 | var options = builder.BuildFeaturePolicyOptions();
27 | string headerValue = options.ToString();
28 |
29 | Assert.Equal("payment 'self' https://www.google.com", headerValue);
30 | }
31 |
32 | [Fact]
33 | public void PaymentFromNowhereAndFullScreenFromSelf_SetsValue()
34 | {
35 | var builder = new FeaturePolicyBuilder();
36 |
37 | builder.AllowPayment.FromNowhere();
38 | builder.AllowFullscreen.FromSelf();
39 | var options = builder.BuildFeaturePolicyOptions();
40 | string headerValue = options.ToString();
41 |
42 | Assert.Equal("fullscreen 'self'; payment 'none'", headerValue);
43 | }
44 |
45 | [Fact]
46 | public void OtherNewFeatureFromSelf_SetsValue()
47 | {
48 | var builder = new FeaturePolicyBuilder();
49 |
50 | builder.AllowOtherFeature("new-feature").FromSelf();
51 | var options = builder.BuildFeaturePolicyOptions();
52 | string headerValue = options.ToString();
53 |
54 | Assert.Equal("new-feature 'self'", headerValue);
55 | }
56 | }
57 | }
58 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/FeaturePolicyMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.Text;
4 | using System.Threading.Tasks;
5 | using Joonasw.AspNetCore.SecurityHeaders.FeaturePolicy;
6 | using Joonasw.AspNetCore.SecurityHeaders.FeaturePolicy.Options;
7 | using Microsoft.AspNetCore.Http;
8 | using Microsoft.Extensions.Options;
9 | using Xunit;
10 |
11 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
12 | {
13 | public class FeaturePolicyMiddlewareTests
14 | {
15 | [Fact]
16 | public async Task FeaturePolicyHeaderAddedCorrectly()
17 | {
18 | string headerValue = null;
19 | RequestDelegate mockNext = (HttpContext ctx) =>
20 | {
21 | headerValue = ctx.Response.Headers["Feature-Policy"];
22 | return Task.CompletedTask;
23 | };
24 | var options = Options.Create(new FeaturePolicyOptions
25 | {
26 | Autoplay = new FeaturePolicyAutoplayOptions
27 | {
28 | AllowSelf = true
29 | },
30 | Payment = new FeaturePolicyPaymentOptions
31 | {
32 | AllowNone = true
33 | },
34 | Speaker = new FeaturePolicySpeakerOptions
35 | {
36 | AllowSelf = true,
37 | AllowedOrigins = new List
38 | {
39 | "https://site1",
40 | "https://site2"
41 | }
42 | },
43 | Other = new Dictionary
44 | {
45 | ["some-new-one"] = new FeaturePolicyOtherFeatureOptions("some-new-one")
46 | {
47 | AllowSelf = true
48 | }
49 | }
50 | });
51 | var mockContext = new DefaultHttpContext();
52 | var sut = new FeaturePolicyMiddleware(mockNext, options);
53 |
54 | await sut.Invoke(mockContext);
55 |
56 | Assert.Equal("speaker 'self' https://site1 https://site2; payment 'none'; autoplay 'self'; some-new-one 'self'", headerValue);
57 | }
58 | }
59 | }
60 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/FrameOptionsMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System.Threading.Tasks;
2 | using Joonasw.AspNetCore.SecurityHeaders.XFrameOptions;
3 | using Microsoft.AspNetCore.Http;
4 | using Microsoft.Extensions.Options;
5 | using Xunit;
6 |
7 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
8 | {
9 | public class FrameOptionsMiddlewareTests
10 | {
11 | [Theory]
12 | [InlineData(XFrameOptionsOptions.XFrameOptionsValues.Deny, null, "DENY")]
13 | [InlineData(XFrameOptionsOptions.XFrameOptionsValues.SameOrigin, null, "SAMEORIGIN")]
14 | [InlineData(XFrameOptionsOptions.XFrameOptionsValues.AllowFrom, "https://site.com", "ALLOW-FROM https://site.com")]
15 | public async Task HeaderSetCorrectly(
16 | XFrameOptionsOptions.XFrameOptionsValues value,
17 | string allowedUrl,
18 | string expectedValue)
19 | {
20 | string headerValue = null;
21 | RequestDelegate mockNext = (HttpContext ctx) =>
22 | {
23 | headerValue = ctx.Response.Headers["X-Frame-Options"];
24 | return Task.CompletedTask;
25 | };
26 | var options = Options.Create(new XFrameOptionsOptions
27 | {
28 | HeaderValue = value,
29 | AllowFromUrl = allowedUrl
30 | });
31 | var mockContext = new DefaultHttpContext();
32 | var sut = new XFrameOptionsMiddleware(mockNext, options);
33 |
34 | await sut.Invoke(mockContext);
35 |
36 | Assert.Equal(expectedValue, headerValue);
37 | }
38 | }
39 | }
40 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/HpkpMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.Text;
4 | using System.Threading.Tasks;
5 | using Joonasw.AspNetCore.SecurityHeaders.Hpkp;
6 | using Microsoft.AspNetCore.Http;
7 | using Microsoft.Extensions.Options;
8 | using Xunit;
9 |
10 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
11 | {
12 | public class HpkpMiddlewareTests
13 | {
14 | [Fact]
15 | public async Task HpkpHeaderIsNotIncluded_WhenRequestHeadersAlreadyContainHpkpHeader()
16 | {
17 | RequestDelegate mockNext = (HttpContext ctx) =>
18 | {
19 | return Task.CompletedTask;
20 | };
21 | var options = Options.Create(new HpkpOptions()
22 | {
23 | MaxAgeSeconds = 60,
24 | Pins = new List{"a"}
25 | });
26 | var sut = new HpkpMiddleware(mockNext, options);
27 | var mockContext = new DefaultHttpContext();
28 | mockContext.Response.Headers.Append("Public-Key-Pins", "abc; max-age=60");
29 |
30 | await sut.Invoke(mockContext);
31 | //Invoke throws System.ArgumentException if it tries to add the header again
32 | }
33 |
34 | [Fact]
35 | public async Task HpkpHeaderIsNotIncluded_WhenRequestHeadersAlreadyContainHpkpReportOnlyHeader()
36 | {
37 | bool hpkpHeaderExists = true;
38 | RequestDelegate mockNext = (HttpContext ctx) =>
39 | {
40 | hpkpHeaderExists = ctx.Response.Headers.ContainsKey("Public-Key-Pins");
41 | return Task.CompletedTask;
42 | };
43 | var options = Options.Create(new HpkpOptions()
44 | {
45 | MaxAgeSeconds = 60,
46 | Pins = new List{"a"}
47 | });
48 | var sut = new HpkpMiddleware(mockNext, options);
49 | var mockContext = new DefaultHttpContext();
50 | mockContext.Response.Headers.Append("Public-Key-Pins-Report-Only", "abc; max-age=60");
51 |
52 | await sut.Invoke(mockContext);
53 |
54 | Assert.False(hpkpHeaderExists);
55 | }
56 | }
57 | }
58 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/HstsMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.Text;
4 | using System.Threading.Tasks;
5 | using Joonasw.AspNetCore.SecurityHeaders.Hsts;
6 | using Microsoft.AspNetCore.Http;
7 | using Microsoft.Extensions.Options;
8 | using Xunit;
9 |
10 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
11 | {
12 | public class HstsMiddlewareTests
13 | {
14 | [Fact]
15 | public async Task HstsHeaderIsNotIncluded_WhenRequestHeadersAlreadyContainHstsHeader()
16 | {
17 | RequestDelegate mockNext = (HttpContext ctx) =>
18 | {
19 | return Task.CompletedTask;
20 | };
21 | var options = Options.Create(new HstsOptions()
22 | {
23 | Duration = TimeSpan.FromHours(1)
24 | });
25 | var sut = new HstsMiddleware(mockNext, options);
26 | var mockContext = new DefaultHttpContext();
27 | mockContext.Request.Scheme = "https";
28 | mockContext.Response.Headers.Append("Strict-Transport-Security", "max-age=31536000");
29 |
30 | await sut.Invoke(mockContext);
31 | //Invoke throws System.ArgumentException if it tries to add the header again
32 | }
33 | }
34 | }
35 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/Joonasw.AspNetCore.SecurityHeaders.Tests.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 | net8.0;net9.0
4 | false
5 |
6 |
7 |
10 | all
11 | runtime; build; native; contentfiles; analyzers; buildtransitive
12 |
13 |
14 |
15 |
17 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/ReferrerPolicyMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Threading.Tasks;
3 | using Joonasw.AspNetCore.SecurityHeaders.ReferrerPolicy;
4 | using Microsoft.AspNetCore.Http;
5 | using Microsoft.Extensions.Options;
6 | using Xunit;
7 |
8 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
9 | {
10 | public class ReferrerPolicyMiddlewareTests
11 | {
12 | [Fact]
13 | public async Task SetsHeaderCorrectlyWithSameOrigin()
14 | {
15 | string headerValue = null;
16 | RequestDelegate mockNext = (HttpContext ctx) =>
17 | {
18 | headerValue = ctx.Response.Headers["Referrer-Policy"];
19 | return Task.CompletedTask;
20 | };
21 | var options = Options.Create(new ReferrerPolicyOptions
22 | {
23 | PolicyValue = ReferrerPolicyOptions.ReferrerPolicyValue.SameOrigin
24 | });
25 | var mockContext = new DefaultHttpContext();
26 | var sut = new ReferrerPolicyMiddleware(mockNext, options);
27 |
28 | await sut.Invoke(mockContext);
29 |
30 | Assert.Equal("same-origin", headerValue);
31 | }
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/XFrameOptionsTests.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using Joonasw.AspNetCore.SecurityHeaders.XFrameOptions;
3 | using Xunit;
4 |
5 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
6 | {
7 | public class XFrameOptionsTests
8 | {
9 | [Fact]
10 | public void DenySetByDefault_ResultIsCorrect()
11 | {
12 | var options = new XFrameOptionsOptions();
13 |
14 | Assert.Equal(XFrameOptionsOptions.XFrameOptionsValues.Deny, options.HeaderValue);
15 | }
16 |
17 | [Fact]
18 | public void WhenSetAllowFromUrlIsRequired_ResultIsCorrect()
19 | {
20 | Assert.Throws(() =>
21 | {
22 | var options = new XFrameOptionsOptions(XFrameOptionsOptions.XFrameOptionsValues.AllowFrom);
23 | });
24 | }
25 |
26 | [Fact]
27 | public void WhenSetAllowFromUrlDoesNotThrow_ResultIsCorrect()
28 | {
29 | var options = Record.Exception(() =>
30 | new XFrameOptionsOptions(XFrameOptionsOptions.XFrameOptionsValues.AllowFrom, "https://google.com"));
31 |
32 | Assert.Null(options);
33 | }
34 | }
35 | }
36 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/XXssProtectionTests.cs:
--------------------------------------------------------------------------------
1 | using Joonasw.AspNetCore.SecurityHeaders.XXssProtection;
2 | using Xunit;
3 |
4 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
5 | {
6 | public class XXssProtectionTests
7 | {
8 | [Fact]
9 | public void EnabledAndBlockedByDefault_ResultIsCorrect()
10 | {
11 | var options = new XXssProtectionOptions();
12 |
13 | Assert.True(options.EnableProtection);
14 | Assert.True(options.EnableAttackBlock);
15 | }
16 |
17 | [Fact]
18 | public void EnabledAndBlockedAreOffWhenSet_ResultIsCorrect()
19 | {
20 | var options = new XXssProtectionOptions(false, false);
21 |
22 | Assert.False(options.EnableProtection);
23 | Assert.False(options.EnableAttackBlock);
24 | }
25 | }
26 | }
27 |
--------------------------------------------------------------------------------
/test/Joonasw.AspNetCore.SecurityHeaders.Tests/XssProtectionMiddlewareTests.cs:
--------------------------------------------------------------------------------
1 | using System.Threading.Tasks;
2 | using Joonasw.AspNetCore.SecurityHeaders.XXssProtection;
3 | using Microsoft.AspNetCore.Http;
4 | using Microsoft.Extensions.Options;
5 | using Xunit;
6 |
7 | namespace Joonasw.AspNetCore.SecurityHeaders.Tests
8 | {
9 | public class XssProtectionMiddlewareTests
10 | {
11 | [Theory]
12 | [InlineData(false, false, "0")]
13 | [InlineData(false, true, "1")]
14 | [InlineData(true, true, "1; mode=block")]
15 | public async Task HeaderSetCorrectly(bool enableBlock, bool enableProtection, string expectedValue)
16 | {
17 | string headerValue = null;
18 | RequestDelegate mockNext = (HttpContext ctx) =>
19 | {
20 | headerValue = ctx.Response.Headers["X-XSS-Protection"];
21 | return Task.CompletedTask;
22 | };
23 | var options = Options.Create(new XXssProtectionOptions
24 | {
25 | EnableAttackBlock = enableBlock,
26 | EnableProtection = enableProtection
27 | });
28 | var mockContext = new DefaultHttpContext();
29 | var sut = new XXssProtectionMiddleware(mockNext, options);
30 |
31 | await sut.Invoke(mockContext);
32 |
33 | Assert.Equal(expectedValue, headerValue);
34 | }
35 | }
36 | }
37 |
--------------------------------------------------------------------------------