From 104498172c9354b9b208fd1a2c909396e2049ed9 Mon Sep 17 00:00:00 2001 From: Engincan VESKE <43685404+EngincanV@users.noreply.github.com> Date: Thu, 20 Apr 2023 10:35:25 +0300 Subject: [PATCH] Create a documentation for security headers --- docs/en/UI/AspNetCore/Security-Headers.md | 45 +++++++++++++++++++ docs/en/docs-nav.json | 9 ++++ docs/en/images/security-response-headers.png | Bin 0 -> 12606 bytes 3 files changed, 54 insertions(+) create mode 100644 docs/en/UI/AspNetCore/Security-Headers.md create mode 100644 docs/en/images/security-response-headers.png diff --git a/docs/en/UI/AspNetCore/Security-Headers.md b/docs/en/UI/AspNetCore/Security-Headers.md new file mode 100644 index 0000000000..7da95e1d73 --- /dev/null +++ b/docs/en/UI/AspNetCore/Security-Headers.md @@ -0,0 +1,45 @@ +# Security Headers + +ABP Framework allows you to add frequently used security headers into your application. The following security headers will be added as response headers to your application if you use the `UseAbpSecurityHeaders` middleware: + +* `X-Content-Type-Options`: Tells the browser to not try and guess what a mime-type of a resource might be, and to just take what mime-type the server has returned. +* `X-XSS-Protection`: This is a feature of Internet Explorer, Chrome, and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. +* `X-Frame-Options`: This header can be used to indicate whether or not a browser should be allowed to render a page in a `