Class IdentityServerUiSecurityHeadersFilter

Namespace

Fdyay.IdentityServer.UI.Configuration

Assembly

Fdyay.IdentityServer.UI.dll

Puts a Content-Security-Policy on this library's pages, and refuses to let them be framed.

public sealed class IdentityServerUiSecurityHeadersFilter : IPageFilter, IFilterMetadata

Inheritance

object

IdentityServerUiSecurityHeadersFilter

Implements

IPageFilter

IFilterMetadata

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The pages here are where a user types a password and where a user grants an application access to their data. Until 0.30.0 nothing stopped either being put inside somebody else's page.

The consent screen is the one that matters. A framing attack does not need to forge anything: the attacker overlays the invisible page on a decoy, the user clicks where they were led to click, and the browser submits the real form with the real antiforgery token — because the user really did click the real button. A CSRF token proves the request came from this page, and in a clickjacking attack it did. The only thing that answers it is the browser refusing to render the page in a frame at all.

Scoped to this assembly's pages rather than registered globally. A host has its own Razor pages and its own view of what they may do; a library that quietly imposed default-src 'none' on them would break them somewhere far from here.

Constructors

IdentityServerUiSecurityHeadersFilter(IOptions<IdentityServerOptions>)

Creates the filter, as the container resolves it.

public IdentityServerUiSecurityHeadersFilter(IOptions<IdentityServerOptions> options)

Parameters

options IOptions<IdentityServerOptions>

The server options; their Csp section decides the policy's level and whether the deprecated headers are sent.

Methods

OnPageHandlerExecuted(PageHandlerExecutedContext)

Does nothing: by now the response may have begun, too late to set headers.

public void OnPageHandlerExecuted(PageHandlerExecutedContext context)

Parameters

context PageHandlerExecutedContext

The page whose handler has run.

OnPageHandlerExecuting(PageHandlerExecutingContext)

Sets the interactive pages' Content-Security-Policy on a page of this assembly — and, when the deprecated headers are on, X-Frame-Options: DENY and X-Content-Security-Policy; a host's own pages are left alone.

public void OnPageHandlerExecuting(PageHandlerExecutingContext context)

Parameters

context PageHandlerExecutingContext

The page about to run its handler.

Exceptions

ArgumentNullException

context is null.

OnPageHandlerSelected(PageHandlerSelectedContext)

Does nothing: the headers are set in OnPageHandlerExecuting(PageHandlerExecutingContext).

public void OnPageHandlerSelected(PageHandlerSelectedContext context)

Parameters

context PageHandlerSelectedContext

The page's handler selection.