Disallowing unneeded HTTP headers for non-HTML resources

1
votes

The Sonar test suite makes the interesting point that it should be considered bad practice to send the HTTP headers

  • Content-Security-Policy
  • X-Content-Security-Policy
  • X-Frame-Options
  • X-UA-Compatible
  • X-WebKit-CSP
  • X-XSS-Protection

when sending non-HTML resources.

I currently configure my IIS server using web.config, namely

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <add name="Content-Security-Policy" value="default-src 'self' ; img-src 'self' data:; script-src 'self' cdnjs.cloudflare.com/ajax/libs/html5shiv/" />
                <add name="X-Frame-Options" value="DENY" />
                <add name="X-Content-Type-Options" value="nosniff" />
                <add name="X-Permitted-Cross-Domain-Policies" value="none" />
                <add name="X-UA-Compatible" value="IE=edge" />
                <add name="X-Xss-Protection" value="1; mode=block" />
            </customHeaders>
        </httpProtocol>
    </system.webServer>
</configuration>

But that configuration sends those headers no matter the type of the resource send. How to make IIS selectively add those headers to the right types of files?

1
iishttp-headersweb-configmime-typescontent-security-policy

1 Answers

0
votes

You can use the IIS UrlRewrite module (an IIS extension) and add a custom headers only for html resources. Check this old question.