Web.config SecurityConfig

Web.Config.txt

Refer https://github.com/east-sussex-county-council/Escc.Web.SecurityConfig
**Content Security Policy is quite a bit of restricting the contents that the client can have, so had to be thought out before implementing**
Content-Security-Policy - This is pretty hard to implement as this http-header is to whitelist what contents are allowed in the web site.
Refer : https://rehansaeed.com/content-security-policy-for-asp-net-mvc/ & https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
<system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <add name="X-Frame-Options" value="SAMEORIGIN" />
        <add name="X-Content-Type-Options" value="nosniff" />
        <add name="X-XSS-Protection" value="1; mode=block" />
        <add name="Strict-Transport-Security" value="max-age=31536000"/>
        <add name="Referrer-Policy" value="no-referrer-when-downgrade"/>
      </customHeaders>
    </httpProtocol>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="2147483648" />
      </requestFiltering>
    </security>
</system.webServer>

*** To add Secure Cookies and secure anonymous cookies
=======================================================
<system.web>
    <httpCookies httpOnlyCookies="true" requireSSL="true" />
    <anonymousIdentification enabled="true" cookieRequireSSL="true" />
</system.web>

TO Implement Cache Control in Global.asax
=========================================
void Application_BeginRequest(Object source, EventArgs e)
{
    var app = (HttpApplication)source;
    UrlHandler.Initialise(app.Context);
    var ctx = app.Context;

    if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
    {
        ctx.Response.AddHeader("Cache-Control", "no-cache");
        ctx.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST");
        ctx.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Accept");
        ctx.Response.AddHeader("Access-Control-Max-Age", "1728000");
        var origin = ctx.Request.Headers["origin"] ?? string.Empty;

        if (CorsHelper.OriginAllowed(origin))
        {
            ctx.Response.AddHeader("Access-Control-Allow-Origin", origin);
        }
        HttpContext.Current.Response.End();
    }
}