Update security headers

MyApi/Program.cs

@@ -8,6 +8,7 @@
 using Microsoft.IdentityModel.JsonWebTokens;
 using Microsoft.OpenApi.Models;
 using MyApi;
+using NetEscapades.AspNetCore.SecurityHeaders.Infrastructure;
 using System;
 using System.IO;
 using System.Reflection;
@@ -17,6 +18,13 @@
 var services = builder.Services;
 var configuration = builder.Configuration;
 
+services.AddSecurityHeaderPolicies()
+  .SetPolicySelector((PolicySelectorContext ctx) =>
+  {
+      return SecurityHeadersDefinitions.GetHeaderPolicyCollection(
+          builder.Environment.IsDevelopment());
+  });
+
 // only needed for browser clients
 //services.AddCors(options =>
 //{
@@ -120,8 +128,7 @@
 
 JsonWebTokenHandler.DefaultInboundClaimTypeMap.Clear();
 
-app.UseSecurityHeaders(
-    SecurityHeadersDefinitions.GetHeaderPolicyCollection(app.Environment.IsDevelopment()));
+app.UseSecurityHeaders();
 
 app.UseSwagger();
 app.UseSwaggerUI(c =>

MyApi/SecurityHeadersDefinitions.cs

@@ -4,38 +4,26 @@ namespace MyApi;
 
 public static class SecurityHeadersDefinitions
 {
+    private static HeaderPolicyCollection? policy;
+
     public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
     {
-        var policy = new HeaderPolicyCollection()
+        // Avoid building a new HeaderPolicyCollection on every request for performance reasons.
+        // Where possible, cache and reuse HeaderPolicyCollection instances.
+        if (policy != null) return policy;
+
+        policy = new HeaderPolicyCollection()
             .AddFrameOptionsDeny()
             .AddContentTypeOptionsNoSniff()
             .AddReferrerPolicyStrictOriginWhenCrossOrigin()
             .AddCrossOriginOpenerPolicy(builder => builder.SameOrigin())
             .AddCrossOriginEmbedderPolicy(builder => builder.RequireCorp())
             .AddCrossOriginResourcePolicy(builder => builder.SameOrigin())
             .RemoveServerHeader()
-            .AddPermissionsPolicy(builder =>
-            {
-                builder.AddAccelerometer().None();
-                builder.AddAutoplay().None();
-                builder.AddCamera().None();
-                builder.AddEncryptedMedia().None();
-                builder.AddFullscreen().All();
-                builder.AddGeolocation().None();
-                builder.AddGyroscope().None();
-                builder.AddMagnetometer().None();
-                builder.AddMicrophone().None();
-                builder.AddMidi().None();
-                builder.AddPayment().None();
-                builder.AddPictureInPicture().None();
-                builder.AddSyncXHR().None();
-                builder.AddUsb().None();
-            });
+            .AddPermissionsPolicyWithDefaultSecureDirectives();
 
         AddCspHstsDefinitions(isDev, policy);
 
-        policy.ApplyDocumentHeadersToAllResponses();
-
         return policy;
     }
 

RazorMicrosoftEntraID/Program.cs

@@ -22,7 +22,6 @@
           builder.Environment.IsDevelopment());
   });
 
-
 services.AddTransient<MyApiOneService>();
 services.AddHttpClient();