asp .net核心3的网络安全审计问题

Question

我正试图通过一个B或A级的http://observatory.mozilla.org和我是一个'C‘的分数。我实现了中间件来设置安全头和cookie，但仍然不知道如何修复一些东西。我所有的脚本和javascript都是通过src标记加载的，没有内联样式。有人能给我一些想法来解决我所遇到的各种问题，我似乎找不到解决的办法？

​

​

​

​

我的内容-安全性-策略是默认值-src https：'self'；object-src 'none'；框架祖先'none'；base-uri 'none'；字体-src https：

我的cookie显示：.AspNetCore.Antiforgery.GOAuSILz_xU=CfDJ8D3hsoQ239JIszuJwoP5ibPL-N9p62srnnwCdREtuQ0bGMft1N7bQulP3alJ4DsTVOUX_i76TbLdQtUjp1UgKAFup-FCj46R5vBSBujuDbXJDSbtQ2xgICsW_CofHqShdiLQj8xefPjmQvYYQMEL2d0；path=/；samesite=strict；httponly

这是我的代码：

public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllersWithViews();

        services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.Strict;
            options.Secure = HostingEnvironment.IsDevelopment() ? CookieSecurePolicy.SameAsRequest : CookieSecurePolicy.Always;
            options.HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.None;
        });

        services.AddSession(opts =>
        {
            opts.Cookie.IsEssential = true; // make the session cookie Essential,
            opts.Cookie.HttpOnly = false;
            opts.Cookie.SecurePolicy = HostingEnvironment.IsDevelopment() ? CookieSecurePolicy.SameAsRequest : CookieSecurePolicy.Always;
        });

        services.AddSession();
        services.Configure<Credentials>(Configuration.GetSection("Credentials"));
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseBrowserLink();
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        }

        app.UseSecurityHeadersMiddleware(
           new SecurityHeadersBuilder()
               .AddDefaultSecurePolicy());

        app.UseSession();
        app.UseHttpsRedirection();
        app.UseStaticFiles();

        app.UseRouting();

        //app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
        });
    }

这是web.config，如果你需要的话

<system.webServer>
    <httpProtocol>
      <customHeaders>
        <clear />
        <add name="X-UA-Compatible" value="IE=edge" />
        <add name="Cache-Control" value="public, max-age=31536000" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>

Answer 1

配置服务：

services.Configure<CookiePolicyOptions>(opts =>
            {
                opts.CheckConsentNeeded = _ => true;
                opts.HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.Always;
                opts.Secure = Microsoft.AspNetCore.Http.CookieSecurePolicy.Always;
                opts.MinimumSameSitePolicy = Microsoft.AspNetCore.Http.SameSiteMode.Strict;
            });
            services.AddSession(opts =>
            {
                opts.Cookie.IsEssential = true;
                opts.Cookie.HttpOnly = true;
                opts.Cookie.SecurePolicy = Microsoft.AspNetCore.Http.CookieSecurePolicy.Always;
                opts.Cookie.SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Strict;
            });

不要忘记添加UseCookiePolicy中间件：

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseCookiePolicy(); //here
app.UseSession();
app.UseRouting();

​

​