Security Headers

funkysi1701@gmail.com (funkysi1701) — Sat, 26 Sep 2020 00:00:00 +0000

Have you wondered what info you are leaking via your response headers?, do you want some kind of guide about what headers to set or remove altogether?

Head on over to https://securityheaders.com/ This is a site created by security expert Scott Helme that rates a URL based on what response headers it can see.

I am pleased to say https://www.funkysi1701.com is now getting an A.

So how do you add/remove headers in dotnet core?

In my configure method in Startup.cs I have the following code block.

app.Use(
 next =>
 {
 return async context =>
 {
 context.Response.OnStarting(
 () =>
 {
 context.Response.Headers.Add("Permissions-Policy", "microphone=()");
 context.Response.Headers.Remove("Server");
 context.Response.Headers.Remove("X-Powered-By");
 context.Response.Headers.Remove("X-AspNet-Version");
 return Task.CompletedTask;
 });

 await next(context);
 };
 });

I have only included a few of the headers I am adding as the excellent https://securityheaders.com/ can tell you which headers you should add and what options you might want.

Returning to blogging as a developer

funkysi1701@gmail.com (funkysi1701) — Fri, 25 Sep 2020 20:00:45 +0000

My last blog post was over six months ago.

Covid 19 has hit the world, and I will be honest I have found it a challenging time.

My Blog had gotten into a bit of a mess. It had become fragmented with different versions of the same thing; I will attempt to explain what has become of my blog.

The original WordPress site can currently be found at https://www.pwnedpass.com/ I would prefer it to be on a sub-domain of funkysi1701.com but for some reason I haven’t been able to get that to work, not sure if it is a limitation of my hosting package. I like WordPress, it is very flexible, easy to get blog posts out there. But I want to write content about development and having a site I can tinker with is important to me.

Most of my WordPress blogs have been imported into dev.to and a few extra have been written on this platform. I like dev.to it is a wonderful place to share content and it has one or two extra features I like.

dev.to has an integration with Stackbit/Netlify and this became https://www.funkysi1701.com . I like having a personal site, but having the same content as dev.to. To add content to this site all I need to do is write it on dev.to and some magic will go on behind the scenes and new content will be published.

However, as a developer I don’t like magic, I want to understand what is going on a fiddle with all the settings and make it do what I want.

dev.to has an API, I can build a site in .Net Core and make API calls to fetch the content I want. I understand APIs, I understand .Net and can customise my site exactly how I want it, plus play about with a .net website. This is what https://www.funkysi1701.com is now.

So what have I built so far. I have a Server Side Blazor site running .Net 5. Why Server Side and not Client Side I hear you ask? Well only because I have more experience with Server Side and know how to quickly create a website with that technology, I may change it as time goes by, but we will see.

I have two pages a list of my blog posts and a page that displays the content. Both of these use the dev.to API. I lied, there is a third page I hacked together to do some page redirection from the WordPress URLs. This is something I will change as time goes on.

There are lots of improvements I want to do, there are probably also lots of broken images or links as well. Hopefully, this will result in a good platform to blog about as well as on.

2020-09 on Funky Si's Blog (Dev)

Security Headers

Returning to blogging as a developer