Add Security Module (Lombiq Technologies: OCORE-91)

OrchardCore.sln

@@ -429,6 +429,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "OrchardCore.Themes", "Orcha
  src\OrchardCore.Themes\Directory.Build.targets = src\OrchardCore.Themes\Directory.Build.targets
  EndProjectSection
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OrchardCore.Security", "src\OrchardCore.Modules\OrchardCore.Security\OrchardCore.Security.csproj", "{B02C00A7-33C2-4FEE-9D0F-B14C349ADB68}"
+EndProject
 Global
  GlobalSection(SolutionConfigurationPlatforms) = preSolution
  Debug|Any CPU = Debug|Any CPU
@@ -1139,6 +1141,10 @@ Global
  {D00CF459-396D-49C9-92E2-3FD3C2A59847}.Debug|Any CPU.Build.0 = Debug|Any CPU
  {D00CF459-396D-49C9-92E2-3FD3C2A59847}.Release|Any CPU.ActiveCfg = Release|Any CPU
  {D00CF459-396D-49C9-92E2-3FD3C2A59847}.Release|Any CPU.Build.0 = Release|Any CPU
+ {B02C00A7-33C2-4FEE-9D0F-B14C349ADB68}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {B02C00A7-33C2-4FEE-9D0F-B14C349ADB68}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {B02C00A7-33C2-4FEE-9D0F-B14C349ADB68}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {B02C00A7-33C2-4FEE-9D0F-B14C349ADB68}.Release|Any CPU.Build.0 = Release|Any CPU
  EndGlobalSection
  GlobalSection(SolutionProperties) = preSolution
  HideSolutionNode = FALSE
@@ -1337,6 +1343,7 @@ Global
  {2BC850C3-9846-47E1-9068-AC0A8E5537AC} = {184139CF-C4AB-4FBE-AE19-54C8B3FE5C5E}
  {85EF279B-8F35-476D-9BBD-F503F20712B5} = {184139CF-C4AB-4FBE-AE19-54C8B3FE5C5E}
  {21F459C1-494E-41C9-B221-6C102774A47F} = {184139CF-C4AB-4FBE-AE19-54C8B3FE5C5E}
+ {B02C00A7-33C2-4FEE-9D0F-B14C349ADB68} = {A066395F-6F73-45DC-B5A6-B4E306110DCE}
  EndGlobalSection
  GlobalSection(ExtensibilityGlobals) = postSolution
  SolutionGuid = {46A1D25A-78D1-4476-9CBF-25B75E296341}

src/OrchardCore.Modules/OrchardCore.Security/AdminMenu.cs

@@ -0,0 +1,37 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Localization;
+using OrchardCore.Navigation;
+using OrchardCore.Security.Drivers;
+
+namespace OrchardCore.Security
+{
+ public class AdminMenu : INavigationProvider
+ {
+ private readonly IStringLocalizer S;
+
+ public AdminMenu(IStringLocalizer<AdminMenu> localizer)
+ {
+ S = localizer;
+ }
+
+ public Task BuildNavigationAsync(string name, NavigationBuilder builder)
+ {
+ if (String.Equals(name, "admin", StringComparison.OrdinalIgnoreCase))
+ {
+ builder.Add(S["Security"], NavigationConstants.AdminMenuSecurityPosition, security => security
+ .AddClass("security").Id("security")
+ .Add(S["Settings"], settings => settings
+ .Add(S["Security Headers"], S["Security Headers"].PrefixPosition(), headers => headers
+ .Permission(SecurityPermissions.SecurityHeadersSettings)
+ .Action("Index", "Admin", new { area = "OrchardCore.Settings", groupId = SecurityHeadersSettingsDisplayDriver.SettingsGroupId })
+ .LocalNav()
+ )
+ )
+ );
+ }
+
+ return Task.CompletedTask;
+ }
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/Drivers/SecurityHeadersSettingsDisplayDriver.cs

@@ -0,0 +1,75 @@
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using OrchardCore.DisplayManagement.Entities;
+using OrchardCore.DisplayManagement.Handlers;
+using OrchardCore.DisplayManagement.Views;
+using OrchardCore.Environment.Shell;
+using OrchardCore.Security.ViewModels;
+using OrchardCore.Settings;
+
+namespace OrchardCore.Security.Drivers
+{
+ public class SecurityHeadersSettingsDisplayDriver : SectionDisplayDriver<ISite, SecurityHeadersOptions>
+ {
+ internal const string SettingsGroupId = "SecurityHeaders";
+
+ private readonly IShellHost _shellHost;
+ private readonly ShellSettings _shellSettings;
+ private readonly IHttpContextAccessor _httpContextAccessor;
+ private readonly IAuthorizationService _authorizationService;
+
+ public SecurityHeadersSettingsDisplayDriver(
+ IShellHost shellHost,
+ ShellSettings shellSettings,
+ IHttpContextAccessor httpContextAccessor,
+ IAuthorizationService authorizationService)
+ {
+ _shellHost = shellHost;
+ _shellSettings = shellSettings;
+ _httpContextAccessor = httpContextAccessor;
+ _authorizationService = authorizationService;
+ }
+
+ public override async Task<IDisplayResult> EditAsync(SecurityHeadersOptions settings, BuildEditorContext context)
+ {
+ var user = _httpContextAccessor.HttpContext?.User;
+
+ if (!await _authorizationService.AuthorizeAsync(user, SecurityPermissions.SecurityHeadersSettings))
+ {
+ return null;
+ }
+
+ return Initialize<SecurityHeadersOptions>("SecurityHeadersSettings_Edit", model =>
+ {
+ model.ReferrerPolicy = settings.ReferrerPolicy;
+ }).Location("Content:2").OnGroup(SettingsGroupId);
+ }
+
+ public override async Task<IDisplayResult> UpdateAsync(SecurityHeadersOptions section, BuildEditorContext context)
+ {
+ var user = _httpContextAccessor.HttpContext?.User;
+
+ if (!await _authorizationService.AuthorizeAsync(user, SecurityPermissions.SecurityHeadersSettings))
+ {
+ return null;
+ }
+
+ if (context.GroupId == SettingsGroupId)
+ {
+ var model = new SecurityHeadersOptions();
+
+ await context.Updater.TryUpdateModelAsync(model, Prefix);
+
+ section.ReferrerPolicy = model.ReferrerPolicy;
+
+ if (context.Updater.ModelState.IsValid)
+ {
+ await _shellHost.ReleaseShellContextAsync(_shellSettings);
+ }
+ }
+
+ return await EditAsync(section, context);
+ }
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/Extensions/ApplicationBuilderExtensions.cs

@@ -0,0 +1,56 @@
+using System;
+using OrchardCore.Security;
+using OrchardCore.Security.Middlewares;
+
+namespace Microsoft.AspNetCore.Builder
+{
+ public static class ApplicationBuilderExtensions
+ {
+ public static IApplicationBuilder UseReferrerPolicy(this IApplicationBuilder app, string policyOption)
+ {
+ if (app is null)
+ {
+ throw new ArgumentNullException(nameof(app));
+ }
+
+ if (String.IsNullOrEmpty(policyOption))
+ {
+ throw new ArgumentException($"'{nameof(policyOption)}' cannot be null or empty.", nameof(policyOption));
+ }
+
+ return app.UseMiddleware<ReferrerPolicyMiddleware>(policyOption);
+ }
+
+ public static IApplicationBuilder UseSecurityHeaders(this IApplicationBuilder app)
+ {
+ if (app is null)
+ {
+ throw new ArgumentNullException(nameof(app));
+ }
+
+ return app.UseSecurityHeaders(config => { });
+ }
+
+ public static IApplicationBuilder UseSecurityHeaders(this IApplicationBuilder app, Action<SecurityHeadersBuilder> configureSecurityHeaders)
+ {
+ if (app is null)
+ {
+ throw new ArgumentNullException(nameof(app));
+ }
+
+ if (configureSecurityHeaders is null)
+ {
+ throw new ArgumentNullException(nameof(configureSecurityHeaders));
+ }
+
+ var options = new SecurityHeadersOptions();
+ var builder = new SecurityHeadersBuilder(options);
+
+ configureSecurityHeaders.Invoke(builder);
+
+ options = builder.Build();
+
+ return app.UseReferrerPolicy(options.ReferrerPolicy);
+ }
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/Manifest.cs

@@ -0,0 +1,11 @@
+using OrchardCore.Modules.Manifest;
+
+[assembly: Module(
+ Name = "Security",
+ Author = ManifestConstants.OrchardCoreTeam,
+ Website = ManifestConstants.OrchardCoreWebsite,
+ Version = ManifestConstants.OrchardCoreVersion,
+ Description = "The security module adds the required security headers for the best practices.",
+ Category = "Security",
+ IsAlwaysEnabled = true
+)]

src/OrchardCore.Modules/OrchardCore.Security/Middlewares/ReferrerPolicyMiddleware.cs

@@ -0,0 +1,25 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+
+namespace OrchardCore.Security.Middlewares
+{
+ public class ReferrerPolicyMiddleware
+ {
+ private readonly string _options;
+ private readonly RequestDelegate _next;
+
+ public ReferrerPolicyMiddleware(string options, RequestDelegate next)
+ {
+ _options = options;
+ _next = next ?? throw new ArgumentNullException(nameof(next));
+ }
+
+ public Task Invoke(HttpContext context)
+ {
+ context.Response.Headers[SecurityHeader.ReferrerPolicy] = _options;
+
+ return _next.Invoke(context);
+ }
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/OrchardCore.Security.csproj

@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk.Razor">
+
+ <PropertyGroup>
+ <AddRazorSupportForMvc>true</AddRazorSupportForMvc>
+ <!-- NuGet properties-->
+ <Title>OrchardCore Security</Title>
+ <Description>
+ $(OCCMSDescription)
+
+ The security module adds the required security headers for the best practices.
+ </Description>
+ <PackageTags>$(PackageTags) OrchardCoreCMS</PackageTags>
+ </PropertyGroup>
+
+ <ItemGroup>
+ <FrameworkReference Include="Microsoft.AspNetCore.App" />
+ </ItemGroup>
+
+ <ItemGroup>
+ <ProjectReference Include="..\..\OrchardCore\OrchardCore.DisplayManagement\OrchardCore.DisplayManagement.csproj" />
+ <ProjectReference Include="..\..\OrchardCore\OrchardCore.Module.Targets\OrchardCore.Module.Targets.csproj" />
+ <ProjectReference Include="..\..\OrchardCore\OrchardCore.Navigation.Core\OrchardCore.Navigation.Core.csproj" />
+ </ItemGroup>
+
+</Project>

src/OrchardCore.Modules/OrchardCore.Security/Permissions.cs

@@ -0,0 +1,25 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using OrchardCore.Security.Permissions;
+
+namespace OrchardCore.Security
+{
+ public class SecurityPermissions : IPermissionProvider
+ {
+ public static readonly Permission SecurityHeadersSettings = new("SecurityHeadersSettings", "Manage Security Headers Settings");
+
+ public Task<IEnumerable<Permission>> GetPermissionsAsync()
+ => Task.FromResult(new[] { SecurityHeadersSettings }.AsEnumerable());
+
+ public IEnumerable<PermissionStereotype> GetDefaultStereotypes()
+ => new[]
+ {
+ new PermissionStereotype
+ {
+ Name = "Administrator",
+ Permissions = new[] { SecurityHeadersSettings }
+ },
+ };
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/ReferrerPolicyOptions.cs

@@ -0,0 +1,21 @@
+namespace OrchardCore.Security
+{
+ public static class ReferrerPolicyOptions
+ {
+ public static readonly string NoReferrer = "no-referrer";
+
+ public static readonly string NoReferrerWhenDowngrade = "no-referrer-when-downgrade";
+
+ public static readonly string Origin = "origin";
+
+ public static readonly string OriginWhenCrossOrigin = "origin-when-cross-origin";
+
+ public static readonly string SameOrigin = "same-origin";
+
+ public static readonly string StrictOrigin = "strict-origin";
+
+ public static readonly string StrictOriginWhenCrossOrigin = "strict-origin-when-cross-origin";
+
+ public static readonly string UnsafeUrl = "unsafe-url";
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/SecurityHeader.cs

@@ -0,0 +1,7 @@
+namespace OrchardCore.Security
+{
+ public static class SecurityHeader
+ {
+ public const string ReferrerPolicy = "Referrer-Policy";
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/SecurityHeaderDefaults.cs

@@ -0,0 +1,8 @@
+namespace OrchardCore.Security
+{
+ public static class SecurityHeaderDefaults
+ {
+ // TODO: Set the default security headers values
+ public static readonly string ReferrerPolicy = ReferrerPolicyOptions.NoReferrer;
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/SecurityHeadersBuilder.cs

@@ -0,0 +1,35 @@
+using System;
+
+namespace OrchardCore.Security
+{
+ public class SecurityHeadersBuilder
+ {
+ private readonly SecurityHeadersOptions _options;
+
+ private string _referrerPolicy;
+
+ public SecurityHeadersBuilder(SecurityHeadersOptions options)
+ {
+ _options = options;
+ }
+
+ public SecurityHeadersBuilder AddReferrerPolicy(string policyOption)
+ {
+ if (String.IsNullOrEmpty(policyOption))
+ {
+ throw new ArgumentException($"'{nameof(policyOption)}' cannot be null or empty.", nameof(policyOption));
+ }
+
+ _referrerPolicy = policyOption;
+
+ return this;
+ }
+
+ public SecurityHeadersOptions Build()
+ {
+ _options.ReferrerPolicy = _referrerPolicy;
+
+ return _options;
+ }
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/SecurityHeadersOptions.cs

@@ -0,0 +1,7 @@
+namespace OrchardCore.Security
+{
+ public class SecurityHeadersOptions
+ {
+ public string ReferrerPolicy { get; set; } = SecurityHeaderDefaults.ReferrerPolicy;
+ }
+}

src/OrchardCore.Modules/OrchardCore.Security/Services/SecurityHeadersOptionsConfiguration.cs

@@ -0,0 +1,22 @@
+using Microsoft.Extensions.Options;
+
+namespace OrchardCore.Security.Services
+{
+ public class SecurityHeadersOptionsConfiguration : IConfigureOptions<SecurityHeadersOptions>
+ {
+ private readonly SecurityHeadersService _securityHeadersService;
+
+ public SecurityHeadersOptionsConfiguration(SecurityHeadersService securityHeadersService)
+ {
+ _securityHeadersService = securityHeadersService;
+ }
+
+ public void Configure(SecurityHeadersOptions options)
+ {
+ var securityHeadersSettings = _securityHeadersService.GetSettingsAsync()
+ .GetAwaiter().GetResult();
+
+ options.ReferrerPolicy = securityHeadersSettings.ReferrerPolicy;
+ }
+ }
+}