skills.rest
AGIBuild
AGIBuildCOMMUNITY
Explore all skills by this author →
GitHub

security-headers

Configures HTTP security headers and Content Security Policy middleware for ASP.NET Core applications.

Updated Mar 8, 2026
Search Tags:#security headers#middleware#asp.net core#hsts#content security policy#razor pages#xss prevention
One-click install
npx skills add https://github.com/AGIBuild/dotnet.CI.template --skill security-headers-agibuild
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-headers
Source: https://github.com/AGIBuild/dotnet.CI.template/tree/main/.cursor/skills/security-headers
Command: npx skills add https://github.com/AGIBuild/dotnet.CI.template --skill security-headers-agibuild

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications without proper HTTP security headers are exposed to XSS, clickjacking, MIME sniffing, and man-in-the-middle attacks. This Skill provides production-ready middleware patterns for ASP.NET Core Razor Pages applications to configure CSP, HSTS, X-Frame-Options, and other security headers correctly. ## Core Features & Use Cases - Security Headers Middleware: Custom middleware patterns for X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy with extension-method registration. - Content Security Policy: Full CSP configuration including nonce-based inline script support via Tag Helpers, per-environment options, and violation report endpoints. - HSTS Configuration: Production HSTS setup with preload considerations, plus conditional headers for specific routes and static files. - Use Case: When hardening a Razor Pages app before launch, apply these patterns to add a strict CSP with nonces, enable HSTS with preload, and set up a /api/csp-report endpoint to monitor violations. ## Quick Start Ask the AI to add a Content Security Policy and security headers middleware to my ASP.NET Core Program.cs with nonce support for inline scripts.

Frequently Asked Questions about security-headers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add security headers in ASP.NET Core?▼

Create custom middleware that sets headers like X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy on every response, then register it early in the pipeline via an extension method. Use app.UseHsts() for Strict-Transport-Security in non-development environments.

How to configure Content Security Policy in ASP.NET Core?▼

Build the CSP string in middleware with directives like default-src 'self', script-src, style-src, and img-src, then set the Content-Security-Policy response header. For inline scripts, generate a per-request nonce and reference it via a Tag Helper in Razor views.

Does ASP.NET Core support HSTS preload?▼

Yes, configure HSTS with builder.Services.AddHsts, setting MaxAge to at least one year, IncludeSubDomains to true, and Preload to true. Only enable preload after verifying HTTPS works across all subdomains, then submit the domain to hstspreload.org.

How do I allow inline scripts with a strict CSP?▼

Use a nonce-based approach: generate a cryptographically random nonce per request, store it in HttpContext.Items, include 'nonce-{value}' in the script-src directive, and add the nonce attribute to script tags via a Tag Helper.

Why is my CSP blocking legitimate scripts or styles?▼

CSP blocks any source not explicitly allowlisted, including inline scripts and third-party CDNs. Check the browser console for the violated directive, add the required source to the matching directive, and set up a report-uri endpoint to log violations.

When should I not use X-Frame-Options DENY?▼

Avoid DENY when your pages must be embedded in iframes, such as Stripe payment frames. Use SAMEORIGIN instead and align it with the CSP frame-ancestors directive to prevent conflicting header values.

Related Skills

Explore More Software Engineering Skills→
AGIBuildAGIBuild
10

Razor Pages Patterns

Enforce ASP.NET Core Razor Pages best practices for structure, security, and maintainability.

Community
Advanced
Arete-ConsortiumArete-Consortium
4

web-security-hardener

Configures security headers, CSP policies, CORS, and input validation for web applications.

Official
Intermediate
imaginationeverywhereimaginationeverywhere

security-best-practices-standard

Implements authentication, authorization, validation, and OWASP Top 10 protections for APIs.

Official
Advanced
JayRHaJayRHa
3

nginx-config-pro

Generate nginx reverse-proxy configurations with TLS, caching, and security headers.

Community
Advanced