Missing security headers (ARCH342)

Key dotnet.security.missing-security-headers · Severity info · Category security · CWE CWE-693

The file that builds the pipeline (Program.cs with WebApplication.CreateBuilder, or Startup.Configure) is where headers middleware is installed. When it maps endpoints and neither calls UseHsts() nor sets a security header, responses go out without HSTS, CSP or nosniff. Reported as info: a reverse proxy may add them.

Incorrect

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
app.MapControllers();
app.Run();

Correct

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
if (!app.Environment.IsDevelopment()) app.UseHsts();
app.Use(async (ctx, next) =>
{
    ctx.Response.Headers["X-Content-Type-Options"] = "nosniff";
    ctx.Response.Headers["Content-Security-Policy"] = "default-src 'self'";
    await next();
});
app.MapControllers();
app.Run();

Fix

Call app.UseHsts() outside Development and add a headers middleware (for example NetEscapades.AspNetCore.SecurityHeaders) or set X-Content-Type-Options, Content-Security-Policy and X-Frame-Options yourself.