Clientside security with the Security Header Injection Module SHIM
summary
An open‑source HTTP module called SHIM injects client‑side security headers into ASP.NET responses by changing three web.config entries and registering the module; it targets ASP.NET 4.5 and the CodePlex repo. Default settings enforce Content-Security-Policy (with a web‑forms preset that permits unsafe‑inline/unsafe‑eval), HSTS for one year with subdomains, X-Frame-Options: DENY, X-XSS-Protection and X-Content-Type-Options. Live demos show injected scripts blocked, cached pages forced to revalidate, and framing attempts denied; pages can be excluded via config.
AI-written summary · about
chapters (21)
- 0:00Start
- 0:31Introduction
- 1:25OWASP Secure Headers Project
- 2:23Demo
- 6:58SHIM Overview
- 7:37Web.config Registration
- 8:09HTTP Headers Supported
- 8:32Caching Headers
- 8:52Cache-Control Options
- 9:12Expires Options
- 9:30Pragma Options
- 9:46Caching Configuration
- 10:07X-FRAME-OPTIONS Header
- 11:34X-FRAME-OPTIONS Configuration
- 13:46Strict-Transport-Security Configuration
- 15:09X-Content-Type-Options Configuration
- 16:21X-XSS-Protection Configuration
- 20:53Content-Security Policy Example
- 22:33Content Security-Policy Configuration
- 24:00Exclude Lists Configuration
- 32:07Project Location
related talks
26mHTTP Headers - The Simplest Security
31mHTTP Security Headers: A Technology History Through Scar Tissue
48mAdd more protection with HTTP Security Headers
38mWhy Do We Need Security Headers?
24mTurn Your Browser into a Hacker Trap with HTTP Security Headers
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
59mHTTP Security Headers You Need To Have On Your Web Apps
59mThe Final Frontier: Security APIs in Modern Browsers