From 2a0dab9a2e030045056207aaea174a80f36ea583 Mon Sep 17 00:00:00 2001
From: Engincan VESKE <43685404+EngincanV@users.noreply.github.com>
Date: Thu, 20 Apr 2023 10:07:27 +0300
Subject: [PATCH 1/3] Add custom security header support to security header
 middleware

---
 .../Security/AbpSecurityHeadersMiddleware.cs  | 21 ++++++++++++++-----
 .../Security/AbpSecurityHeadersOptions.cs     |  9 ++++++++
 .../SecurityHeadersTestController_Tests.cs    |  9 ++++++++
 3 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
index 37c18f6b70..29e05b9bdc 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
@@ -20,27 +20,38 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
     public async Task InvokeAsync(HttpContext context, RequestDelegate next)
     {
         /*X-Content-Type-Options header tells the browser to not try and “guess” what a mimetype of a resource might be, and to just take what mimetype the server has returned as fact.*/
-        AddHeaderIfNotExists(context, "X-Content-Type-Options", "nosniff");
+        AddHeader(context, "X-Content-Type-Options", "nosniff");
 
         /*X-XSS-Protection is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks*/
-        AddHeaderIfNotExists(context, "X-XSS-Protection", "1; mode=block");
+        AddHeader(context, "X-XSS-Protection", "1; mode=block");
 
         /*The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object>. SAMEORIGIN makes it being displayed in a frame on the same origin as the page itself. The spec leaves it up to browser vendors to decide whether this option applies to the top level, the parent, or the whole chain*/
-        AddHeaderIfNotExists(context, "X-Frame-Options", "SAMEORIGIN");
+        AddHeader(context, "X-Frame-Options", "SAMEORIGIN");
 
         if (Options.Value.UseContentSecurityPolicyHeader)
         {
-            AddHeaderIfNotExists(context, "Content-Security-Policy",
+            AddHeader(context, "Content-Security-Policy",
                 Options.Value.ContentSecurityPolicyValue.IsNullOrEmpty()
                     ? "object-src 'none'; form-action 'self'; frame-ancestors 'none'"
                     : Options.Value.ContentSecurityPolicyValue);
         }
+        
+        foreach (var (key, value) in Options.Value.Headers)
+        {
+            AddHeader(context, key, value, true);
+        }
 
         await next.Invoke(context);
     }
 
-    protected virtual void AddHeaderIfNotExists(HttpContext context, string key, string value)
+    protected virtual void AddHeader(HttpContext context, string key, string value, bool overrideIfExists = false)
     {
+        if (overrideIfExists && context.Response.Headers.TryGetValue(key, out _))
+        {
+            context.Response.Headers[key] = value;
+            return;
+        }
+        
         context.Response.Headers.AddIfNotContains(new KeyValuePair<string, StringValues>(key, value));
     }
 }
diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
index 198a62723c..93b0dc9236 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
@@ -1,3 +1,5 @@
+using System.Collections.Generic;
+
 namespace Volo.Abp.AspNetCore.Security;
 
 public class AbpSecurityHeadersOptions
@@ -5,4 +7,11 @@ public class AbpSecurityHeadersOptions
     public bool UseContentSecurityPolicyHeader { get; set; }
 
     public string ContentSecurityPolicyValue { get; set; }
+
+    public Dictionary<string, string> Headers { get; }
+
+    public AbpSecurityHeadersOptions()
+    {
+        Headers = new Dictionary<string, string>();
+    }
 }
diff --git a/framework/test/Volo.Abp.AspNetCore.Mvc.Tests/Volo/Abp/AspNetCore/Mvc/Security/Headers/SecurityHeadersTestController_Tests.cs b/framework/test/Volo.Abp.AspNetCore.Mvc.Tests/Volo/Abp/AspNetCore/Mvc/Security/Headers/SecurityHeadersTestController_Tests.cs
index fdfda83ac9..7c704905e9 100644
--- a/framework/test/Volo.Abp.AspNetCore.Mvc.Tests/Volo/Abp/AspNetCore/Mvc/Security/Headers/SecurityHeadersTestController_Tests.cs
+++ b/framework/test/Volo.Abp.AspNetCore.Mvc.Tests/Volo/Abp/AspNetCore/Mvc/Security/Headers/SecurityHeadersTestController_Tests.cs
@@ -15,6 +15,7 @@ public class SecurityHeadersTestController_Tests : AspNetCoreMvcTestBase
         services.Configure<AbpSecurityHeadersOptions>(options =>
         {
             options.UseContentSecurityPolicyHeader = true;
+            options.Headers["Referrer-Policy"] = "no-referrer";
         });
 
         base.ConfigureServices(context, services);
@@ -30,4 +31,12 @@ public class SecurityHeadersTestController_Tests : AspNetCoreMvcTestBase
         responseMessage.Headers.ShouldContain(x => x.Key == "X-Content-Type-Options" & x.Value.First().ToString() == "nosniff");
         responseMessage.Headers.ShouldContain(x => x.Key == "Content-Security-Policy" & x.Value.First().ToString() == "object-src 'none'; form-action 'self'; frame-ancestors 'none'");
     }
+
+    [Fact]
+    public async Task SecurityHeaders_Custom_Headers_Should_Be_Added()
+    {
+        var responseMessage = await GetResponseAsync("/SecurityHeadersTest/Get");
+        responseMessage.Headers.ShouldNotBeEmpty();
+        responseMessage.Headers.ShouldContain(x => x.Key == "Referrer-Policy" && x.Value.First().ToString() == "no-referrer");
+    }
 }

From 104498172c9354b9b208fd1a2c909396e2049ed9 Mon Sep 17 00:00:00 2001
From: Engincan VESKE <43685404+EngincanV@users.noreply.github.com>
Date: Thu, 20 Apr 2023 10:35:25 +0300
Subject: [PATCH 2/3] Create a documentation for security headers

---
 docs/en/UI/AspNetCore/Security-Headers.md    |  45 +++++++++++++++++++
 docs/en/docs-nav.json                        |   9 ++++
 docs/en/images/security-response-headers.png | Bin 0 -> 12606 bytes
 3 files changed, 54 insertions(+)
 create mode 100644 docs/en/UI/AspNetCore/Security-Headers.md
 create mode 100644 docs/en/images/security-response-headers.png

diff --git a/docs/en/UI/AspNetCore/Security-Headers.md b/docs/en/UI/AspNetCore/Security-Headers.md
new file mode 100644
index 0000000000..7da95e1d73
--- /dev/null
+++ b/docs/en/UI/AspNetCore/Security-Headers.md
@@ -0,0 +1,45 @@
+# Security Headers
+
+ABP Framework allows you to add frequently used security headers into your application. The following security headers will be added as response headers to your application if you use the `UseAbpSecurityHeaders` middleware:
+
+* `X-Content-Type-Options`: Tells the browser to not try and guess what a mime-type of a resource might be, and to just take what mime-type the server has returned.
+* `X-XSS-Protection`: This is a feature of Internet Explorer, Chrome, and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
+* `X-Frame-Options`: This header can be used to indicate whether or not a browser should be allowed to render a page in a `<iframe>` tag. By specifying this header value as *SAMEORIGIN*, you can make it displayed in a frame on the same origin as the page itself.
+* `Content-Security-Policy`: This response header allows you to restrict which resources (such as JavaScript, CSS, images, manifests, etc.) can be loaded, and the URLs that they can be loaded from. This security header only will be added if you configure the `AbpSecurityHeadersOptions` class and enable it.
+
+## Configuration
+
+### AbpSecurityHeadersOptions
+
+`AbpSecurityHeadersOptions` is the main class to enable the `Content-Security-Policy` header, define its value and set other security headers that you want to add to your application.
+
+**Example:**
+
+```csharp
+Configure<AbpSecurityHeadersOptions>(options => 
+{
+    options.UseContentSecurityPolicyHeader = true; //false by default
+    options.ContentSecurityPolicyValue = "object-src 'none'; form-action 'self'; frame-ancestors 'none'";
+
+    //adding additional security headers
+    options.Headers["Referrer-Policy"] = "no-referrer";
+});
+```
+
+> If the header is the same, the additional security headers you defined take precedence over the default security headers. In other words, it overrides the default security headers' values.
+
+## Security Headers Middleware
+
+Security Headers middleware is an ASP.NET Core request pipeline [middleware](https://docs.microsoft.com/en-us/aspnet/core/fundamentals/middleware) that adds pre-defined security headers to your application, including `X-Content-Type-Options`, `X-XSS-Protection`, and `X-Frame-Options`. Additionally, this middleware also includes those unique security headers in your application if you configure the `AbpSecurityHeadersOptions` as mentioned above.
+
+**Example:**
+
+```csharp
+app.UseAbpSecurityHeaders();
+```
+
+> You can add this middleware into the `OnApplicationInitialization` method of your module class to register it to the request pipeline. This middleware is already configured in the [ABP Commercial Startup Templates](https://docs.abp.io/en/commercial/latest/startup-templates/index), so you don't need to manually add it if you are using one of these startup templates.
+
+After, you have registered the `UseAbpSecurityHeaders` middleware into the request pipeline, the defined security headers will be shown in the response headers as in the figure:
+
+![](../../images/security-response-headers.png)
\ No newline at end of file
diff --git a/docs/en/docs-nav.json b/docs/en/docs-nav.json
index fa688814b3..860c7ec214 100644
--- a/docs/en/docs-nav.json
+++ b/docs/en/docs-nav.json
@@ -826,6 +826,15 @@
                   "path": "UI/AspNetCore/Page-Toolbar-Extensions.md"
                 }
               ]
+            },
+            {
+              "text": "Security",
+              "items": [
+                {
+                  "text": "Security Headers",
+                  "path": "UI/AspNetCore/Security-Headers.md"
+                }
+              ]
             }
           ]
         },
diff --git a/docs/en/images/security-response-headers.png b/docs/en/images/security-response-headers.png
new file mode 100644
index 0000000000000000000000000000000000000000..8e90a70719b9ba994c208910172146e993382d2c
GIT binary patch
literal 12606
zcmcJ0Wl&t-mn{~wad&rjcZlE)jcafZ?(Tsg4Fq?0cMsA*1C0g^H11A-;rE|c^WoKd
zQ#14GeYmo#&aJv~&RTn~y>5(}$_I2*5>yx%81zpc<uqVmU=7~Re;^~i?fs=_hu;pc
z?iwFtU}~qx4&DL;YiVU^7?_4cw7+KW-eMG&k3e@A7@RNvY_RK}DZOD}xPE<-lh*P!
zKFJAkFj{DV63$c}YF3D7I(ej6M<ST;;A+DycY4RBDG0p(B-PDi>hhwHHM~?zF!!{B
zKkBCWZhqc%&1Wt?Jlj-IJ=~hEJx112?c=4nL(JHDe1mo|#P^R#YK)c1h|igJqRN5u
zwEolLGIUh@u57v`<>s4;Ti|Kaodnc>THl^>!(;T%hdw>TNHe0(@*O(^gwBmiJb<BU
zF0aa0;z+X${O}Qw84&}Vp2J&26a3!_Chnn~CSih4y>NF`^jY?ruc)de^MfZJ!GfEF
z<6SO$oadjR&YScdI_EvmSKhy}H{>uTe^Fj8W`g?d?E-vUYbPCp*ojJI<jj}X^Zqh)
zFBcLJMVdLu>c}~a`}&sSmbJYg<W+gxy{6Yy2*2IyYGOavV9c{g)SqV)9mPO`*XO$P
z<JZ6F{x1;$Hc3^F+C=^j&iSWRLVi1#=QFSO>^046b`d?367Me_*3L}9RbIf|R}81X
z)#VRPuQD818_yz!4_%x?zwNM1i5WH?1#SFPIXVpQOx96e^N+UOcAFMta~PY^DPoan
zyRV0w2Q@b|(4tRX{Mvk0p*2rX_n^>{L(ZomWNOFyqno|K^iAgM^wGV2!bmeXlxByZ
zzdxL}+WMv`Cd4xyYd+XC&0OMNsTn`@0mDJ}5Zz5eNjmW2D;1J!&|J^-?}eb9aOQIV
z^cfs4soxv#!g+chtv=YG7&-;zqE4wN&Ip9N5{fO{Dc?u%qex$E5^9R#U1{GNc<o@>
zZ3xCk_g%|6zkV$6_~uMnulmtuLB@D7%8W=d#JnpQbkq>^n4|A@6;%6|qI5<BH7r~@
zIwmk<)|>})+O{jw7-?7#=^TJEvdz){L41q>FC=B!js{K1;fY+SQkh3-E0wZ+x~&gm
zBc%zo5&8GiT7V!qrB0%uBNKM>1SPIa)zNL;d7}H}2*c|AyJm8?!)rAt<>vP#UqUfC
zbBC{OhY~l09fN9mq+f(pOD?-507Lg<Bu&p7XU`Nr0v|rK&^@G&NXl-Ey=p4@Y`fLv
zM5R@$Q;+>X?ZJJy?FtIX(kDtYHNggzl3LIgop-mH8Z34C<5dQE-r7Eu;AGXUAGDtL
z-t%@d8ah{Hcb&;eV^n>p6^PDcQzII{X8zusL<0F;F_8=rN^`C@Q5QVej=PE-zj_xf
z{K9#TM$Yl^d7xW~?p<@pAaZB+OyJvEh@XLNq%2$83a9M*mN$c1HL9lovVZ(7O3eT@
z1bxe9+GDB_FbEDO3U7zrZ8&yp={%HRYb0hns*%S1@q7Jbg44$(DaUQ}<+bHrp-Ri3
z703NAVNeT1ben~#6FtI&GSZB$z+BN47`uTp`g(wNpB^C@_t5QqCTSYyX`=2T-+j^3
zH<)a=<9RT96Y#4s$=L5^V>ry2!p>^eHk*^Q7ZH;={o!i*!tm@F<#WVtgw9sb;?q(=
zge2jgJtPS2v;ZF1{`Ezd--}S}bJ|@Gv=27S#+8IyK2f^;ESE4|IM=*};p;Pf+l_%a
zshiQ;?feaoWxqJ(d}Rt3FaQYRfdkSoZ=AQ3pM&Q%Q#~VQBho^pP58<^goy7RuKGG9
zZyD`@$3;f_ef?J0g3U6BpDD%jEuskAu>XBdR87anaUO1VXmtksc-Ad`abVLoIbKt9
zApKvTp1D;{U4~WaqN{ok<yx(%i@BO+BRGKo3}eV`GTy?x>QNd(cjR6<?+gbHYSJRy
zsQfVC$b@`Q+2<q6Zs+t@eg2hSEDATMq_t}ZnXXvXM+WWmB{{VQ9rj-n-kzz8<8_>Q
zh|4~`o6X=2^-B5v9okIMBe37l1;XL5{DyyWFmdcdTuKP_|A66t67-XUqrY3fU8jTG
z`aeKOr+|hWieT~SXP8^EJayKIkJMJy>mftUX9HeJB(9}cpYx$FNcq+Z>?${dKc4)|
z^x12XGk?`%PIss)@2z1sekny4I2E0|Q-W2x6IraT_mf+<m}+o5fB)W*1-`9&X-cIw
zc#H*=+0WJvXU;BAnJT=rTQDm<G~Du#1|V=PWuU<hjqyJBjq66*o*o>x*WLPM&upVv
zmBCh>{1kC(OJNgX=K9;_FjT*VoeXD%AUIXxltt+l_RB*0S%fjLVF8kxiD;_hSoj08
zqxBgkvRa3;=ef~P6;#;Db<?;+3txm31oI(*p6-s@%6r-om`$I4Vs?9vxjEu~$ni72
zKd$|3t8G;238U|1t)SLDOQaW2MC=vhJuMHNSzTMTGP2DH$ZZ+H>7EUOBgwM~&d?v?
zk~UOLgl~2RYnrn2*z!e^<aa8t(>9<l*wu<@sW^NZ#`ub0;3s2=XsX3-_x=eUA#Av6
zqtVdiVZpFaX4h|8c~>u#m8tZ&dl~S_s-#3RgPZ2%0;%zDX&Gf(I6b^9((h;P6;(Jk
z=qH<mbJp^@#+V?c6_47pNN%E0!LA*h6H$wsucITLj<_6w=OS(+5fPzR9y#}>@m{hy
zEVNatAmXUFotpDOURaH)3H%hR8ynq59~eSJ{p^5dgHNMdFV5x9w>g<1g16%jp+oPa
zPuLMuO%OYJ7q#<Z#_cQo67Tea<_Wa~f1mOB936W0z^|C!@v4+2UiO&CT!cp>yGkr$
zzT4m&2{!(TcA^zz!~m&yXL24;6M^O>upebpXzluNnRv??)Q4Y2nPbvh09p4w`g>V-
z{%S&g<;;7eZ-W1{=6yup@^|iXSAJ!P<!Xtq1}kGnW>J~5?{k{A!tyegmA<3Cu~^?<
z+$XWmz}8vddf(raHaU4LBi)uM14Q$wv=2RvjT!puT^Aj@i#N88!>z-Ys*+k@y|TRR
z%k^KSR$wqC1#mq-@$Q7P!}YOa7u`=&CCGBCh&E;y{ezez_U?|ayT259QojX?hu8_{
zVZk9`cOToTK~R{s&Vc0sX+mvQMT+w)DY%ZZ;b~?Avrt(p@|1PDWzvWI*!~m3!m?&*
zf^C@BrJ<;<&vy0)kfcVO+^z4#PS}+CIsfb(z6!9;>zmeCqfz*~oA-_E?Mo?%MLp>u
z5k4Ib&a2(-NOZ&5?$uPrNSHrH0Aly#-0)m^t_I~C*_SO(s#|Eb{M)VXxM`W2kCSHP
zs4hsn<?ymX?#k*7$rqI+;-5`%qdp`b{#CPJGanfAuqsHoVV$;@At-oO6I0aX7|`=W
z?Nk=G%de?}{V|m&3RUzR&(QVay#C?^f32+dL^udAB(e!!7w5NIF2#>jm8d%XMzXYy
z!3Ba43R1G!14qKnl=;SXW%^q+;?FFTc5}iGG;OduA9-M^S1r@+g1TW_&G3KqLBz?!
zjEp)lquHLNtoD0j8P9<vQNn)d7mDXj1gx%)JV0;pdc}><K~w~y?rak_vD=^dF=3qy
z?k5T*h@IM*LwcP3FY{2QKi`qjI;}8#8PAurSOKm1H--+~lED+vjtua5F_}WuCY+zy
z#LV?QvoCQ)F$XI0DBYF2z<a!ZWXVjJE~yoQxZnuokf|}cybw|1e)s~Z6w%`BY7sHK
zSKJQk$zz!)X*l-WCez}e)VE5Q*MlfT;S@sp;aJ#;){kcOJwrY-&di|ALq?bc6jn7o
z1W)f^25gawM&>OXOB_b_bGk@3u8-+vQQVf~qasJ{d9-NjkD1IH1G79^RZ#&iKW&AA
z?_3P*)Yk2<;p7J*LS7mpSXgLVLGpsvu@=wlJ<k|Fw-fT&+h&`lT9@5fe%Mt{ngfxJ
z7A|bre(_W39zxA7Mz>50%yqlqJv9S(czF;>mn3W-CYFi4O(xf)&|_*$7zyiNhH66u
znjzpXDc;zSJS*{xaf=G2JBaLJDIUQ2FtW3dEu7w)ux7V)bkJDBK9fkSzCz7@ZAgo=
zcV9~1;!p(ns8-71$i4j;fsd3r*~39@TFzN8rM1<){u1OEcz<Y?7Zix`Lk!+hO&dMI
zu9ZxSDSlJ$i#e7;$8XNuE)Jc{q>vV6OqdR&uWs(DX&M|?Bf%a{c;!Wv{*0+fk}r+B
z=2-9Xw6n59Bv|D_=z2AAmwK;-pVLAE4~~OREF<h2-v5*k>hV@F=#~#m$Tysf)BW4}
z!2zseBL^06po*zRzCgi{NNO=+wi$ZvfoCvp790+UsKA|x&~Yuu^IMK49O@rw4Cuv;
zrVwM<j?j1_0;+BW5dWB~gPw2Lc}s1`=%ve4Pf>Lj;8pJES$nld5W4mKDMhV3nL$SH
zY{^c#A`m`H*ZAlZCZPH(A3b`yic_(+h}?4GQaN<>Ier7}F8Xy=My%SRndD0yCgJJc
zXs-Wy^tX^Ha;?Dfr&GrIV~0&)OiOI^QIQslCIP)RjILgOmwvs;`^)~oi?p0ISY`U(
zbo+LNq*h&t@7WHXe#KCH)KpUJvV?fz=%cbWms|^eRRMAg$m=@l#lsx&tQCQ2bo92N
z#x$w3!JzLI)-M~%B2Lz5fbGWUE#L{C4O%&oy6$NuN7szV<I185`cQyV!_SC2#qdrQ
zwxQNXIr1ta6Ox%ffzsh?oWd~!wHQZBkHX%tXPkN3nLB~Z=+%<BxYdu~Gmooh6+yvl
z0&9FziQfv_il%+^_j|bfzO!U3>SBvTmcM6Yb$?_9yb+S%?Sky0w-2St9;DC>bmEw}
zvku1kv<14Ui6<-J+}^oXpz4J$ZU0Q%H*V=9tmmNnuB~AAd)P{Cl@DgW7S2}aB3N}b
z_Tf6NBVdyY?q7+E6_^Wv3(M9D7~;b2H~)VO>MMsqfs5LfBuxC`=tEpTSu7?ETJ`gX
zH0DwfpShY}th~=GcQZzJ%{8-9(Q}4Ol%@Mp&t9}&{_?`LGf|@}3A-?!qCK_*PV-;U
z6QnMJ9qw9(ekG1rAs|<T)%jbq{Gpgw#`Iake8`{1_4Q}I3vZKDBCf<VT2wU>ZQ#hW
zcE^{NY-rcNUubv+Z#a(}=t<?iN|mOY6g|88PO5PAnIrsZBeXQ2q!$F4Y>?)zZe)4A
zzOfCP&;3xrPN47i2`}hPB7$AIw)HH7s<>R&*L}a}#}Q+l8^LFqy5H-+mi-1+ogb2_
zFeHX=8f#5B+-_x0pQr^J*ZnT^qwc;P%8HrTkcQo#BSTg-ISm=pwfmNz3s<)KD5|!I
z0cC~eemgbk#qD#~MOWbT9`i2mzz0U(uH3=amfp_4tQ`w|<lsfZG8gs5>dy@~JAs?<
zhkEnyA9rVD*(t*(+LnLSQqAIEe(|IRGna1P!x^*5&kqFD#8Tgh>+K7dn^^iZ9y^$`
zK4O9wUZJYq9d4qKtugn{l<H;ugaN0wy5A=vuuGBNQYuhR9&reD9a@Wv(dXorOp>u2
zddQ#C#{BA5q@4ME*07V@6{q+wUWQH?E;%$`JW4qRshS5pS-FdUzSR!=lSnLO1th2M
zGPixt8&3o@o+^}`1b=%bL?|ja6?%%=vRDY2A572_*)O3cey=86x_eHo@F3fZ{Yj(}
z!&nfEC;n~`_AEjdk&4Tz%X3SYL$1WgHRxlEMv#~FCk?y)PRe|(L%-Ou%7W8zLK$8|
zt)W|SgA0a|uSN5>?cMTDKzpr^4!m5xI^w3Of6k$!E_P829X~=EH)9>$9+y>o?n)&y
zLg**@?a6=5Q-hb{ubQB#Grr&{rNL1qr>wgwo|8YZR;KkOl$F{qf#2RWuadIHC*>pQ
zMblA_oTm*VKyXc!*2W&pth>`}+k1$un4c<sVWtG2FLCA~`Q*P7XoUg9{e9+{^l31E
zORG2Ta6*((GKqD%XAaG3E#Q1lw3azOo7TIp<&7-*67vPk!KXx&?lb3OXk;rYE>kRF
z3Q&g{qh1e2_EIcq%PBBsMv7x@qt~C{c26@cu9osAr*j0O#+=ZwF~!wZsF?gES*jhL
zH$#lvKSJQ|VB4y;G?lhT(jT~7f+fOdby*F~0AjCbgzc5$%J4}bE$*5R=eNuy=-AJ|
zv&qTD7EEO>WR&B)LO&yN05%i)<j0f8T7uv>yu;^Cqn3Ed+o#D4J&Z&|(H!x$tnmlQ
zkgHH5c&KIz>yhO>*Q<VrC_1=|SD1FD&!r;i>8AD?bOT%tGr~G)x|9AMQjPT13@MO1
zNkixtsOJX(2S}gBo`bD_dnB&_<#bHD)0uvIwOf7XTp0wVct3oen-EPHC{q17!1_C#
zN_{U~K2__z126Ht($8VDXJ2mGc46m@$<zRyI7@W0dbU*;GHTUhv0^p@>y;iIlQ<t)
z!5W1sN9YUVkFJ8+J`#pHTW-V9s=R3S2kNz6JMVtONdJhr9SKsjtRzgofpMI1^Xf7{
zH}h+Q4fA4&C>v~MREI0~PH68>n;+>P&g3u(KD8EV$LcJk!5Jg_K&17GOY~aIo~e*K
zC>7wqCz2tY5E?ms>{YdzJ!JOBIrwv&)kb{hB0I3#U2ngxWE%FWH`ysJFENow*^UP<
z*KT7{vyH|ckeI?H&Q$<1;7gBq;7-fMYK`5T>>PIHRpz%4w%ei=jvuR21`efxt!G;x
zi(aDFZ=9TXT#7z*B}5%tdT{l>ZltPCK`ftI^qz_%-dBg)ne11@w4%+O#+SwOaOqmI
z^iU}9s6IDD0RE8vV}Rti@F+v%lhQ-U2Rw_?P(N5jG9a^W##p71kz3)Jl-K6JP1)c@
zrF&t^o_CC9q@vcTWoN;AUmjB2d*EN&ONjR;j3?e@-b<a#jQk|s>Sv*lpm>dQH?dHq
z43_7^?CV81nUb4%(IK_EqQIl*lDT=t*I)#3J^uQh910A^Ko&!rMJW{`Jeho~5Vx8e
zzFGK$o%GG$Y-iHk$mw^&mmzHYm0lnrmXW&|RFCc5cFB&JTNuL5K01JBJ8gUk?{As<
z#vighe>9P35@8FE;Vp$9VNv=h`Lr;8yT1!`XCIyp;8gRc_;~Ls0qrLVu_D9ge%8KM
zK1NleZb%E$LOMoEcJSgX5;{JuccNK4#iY%z@2wwt1r>#~46WbTP@e&MnTzs0F=LZ`
zkH8tW3VPp-<*EsZk2zgjlt)hfz@%9?E}6*Bd(QUfSY*bA<oO$crN997LG!Mq)|Ov@
z`}4HffV9CVUOXIiC|1hDdCr>p7kO#t4`8Ph$A_)B+6cBUUgEZMp{4IsR6U?=gO<`D
zvsw|XMvCQ~>a9P=QDUc2*%{I@vGzp`GeFLC@cj+)NHOD6e`V1%2;s^-1aVw{7vu3o
zagw(R&L8<;55pB*m$UIS7~*UULLXXtul2LhD)d|4dFm@Jd88Q&THHxxNVN=!CCq+~
zDLBc@iC-wb{~zZ5Z^;n<MYZBThSg%xw8XLoME~tsaVy1(fy=>FR${n$OBEsp%}G&M
zgf~!&JFyFULuo$xfR%V8Bh6w<L(N6uWf`t&vLlszrvdSm@ttnI#P5}pMWF2kw){co
z<a*yBK;N)C@xQJ5nLbDuRUYPr7P|!Yq#*8^J$XdqGKtb`IIQspDnA0PHxW00g|3w@
zbXhY!k;0!i((wEHgP)GrY4NuPR`U`7Wpf7jGgVu&$$o2d28=|yo%VP*Ul)Wq^Bfvp
zIL?(&*8Zy-zgt#<Z@YN;ZH!byY)-3XMqjdTb1qiOL?)YgeR%t04WDZPRXVp?>Jla8
zI@ADe9}OL7HT)3QZa$B>eaz<R(CFs;^lo#On}}*6Q$bA#yj_oyt5ZxlLoa;b`zNwM
zvWRNLWEN-L$1q~*Tt&?k4Xz!Jb1J)&V`2LIaZisaPv)7-Pxnij&CAx3z#>;0jT^E1
zV!<3=B3tjGE>fHd>7`xqc)8l#)`RXR=8s<>UBgbDx+VQOJ`X4Ue^cRB+V9Y9__G4K
zp@s9iJUi@;gcUzM)`Sv8xB!|IZ#B$?&>G|CG4r(34h(8GcD4!P<{w{C(_fHWw1Dmh
zK0V5F*L*S6Lwh2-rPj4W%4|<Nn8l$J&ph>9oCL6?U&f>jezZGE|71F+uWtfyyarF4
zQ1;KIDRMz_8*xM-QlzNRH(+W@6L*<)j3JQDO4I+lju3mrX#2o3(S`vSN>z#&MCPww
z)vHdP4J5|w5w25Ga%@>isppa9DhMae_--8j&Wf6G+#In7khJ78X2hW~Sji#CM<p-|
ze?S0k(KS>pLd9$*y31j}#;MOAU^a_642UH`whumJ;g3U(yDtXVz9B@U*@Wynq_G*C
z-<%ODaU8(fJ1u5PAznB_wiKt^dzhb<5640U;nP!JKUVQSa5)gzzd^9}m&dheZ3qAm
zBVCVA^TI}U0>5ABHL4I1@yXm_Er_3)dVaqSR-#7$wr2+2!|LxBwvB(@sR(}Ta%Ug%
zj9IAMf=IM@hb*vcZsq1Q1&v(cqqP>YbQA&8>0@)Qmkgc?6LtJt?|UkH4ZU)Z70DYx
zkjz%j!y9+R48Uj2SIaxd^7r4<d$*n2;j6zrL2OAOs0O{`*6ln-1`uW1W-Z0s;2zbe
z=58v35{^O5WVgCCzeS#;7MIL3V(qTBnieYXXeWinq2J9YA3fl@W$T7m_Sb}lF9_%S
zL9Y=l!k>)Yx+hQ4@>^QAhfA-yOVG{cLt%(nM)q1me7Vm*ZJG!@e$bmZ`LhP_U(+c6
zW7YrXQs)0YtO>P1>yC#vQUzgx%buKI)nR{L9BG3&sB}4W0>bQL963v)u~F@-)0pQ>
zTk7X-J(KjbKi+pXmnmTH2TLrO(QVo=IXE{@SG?fg!CZd)6VM%mwsAcWK;6Vyrw7?t
z#lo4}3(+AGh!OAVUue<nQCmcr5iMxL9OO{7V=3ihNg=TIg}J>3vo$c>5dnpeJ`9IJ
z|ImUFJ2E{Be+V5*_#=Oxr*0Y*N1;hM(INQ)T`K)5TmNzl<|-bpu8@^j>)pXFQ?axa
z8Ev07vRkI84&)go-C`yR6Ra@oGWxthB6NP`2@^oE2DR3vJ>M4A##X=%x_4#tt6eyQ
zJG;e_d0I|Yd~Sj#zz|tv^)g}8f3`uXZL3|b?P{B>Jv!?NJj@;^uIg3EY(uqN5RgTc
zxY?`MOd?v$*+5On2KtPY$6Fc1VGgPI2p%<WH{JJnN1qQM<LhsEuE^Na8abW812mcB
zV4V(a`ko3%Po~p2e!u3=by6EbJuc8VMNLj4UvJ45BsD3&^H?+9fWaw5xT{WbQDgbY
z2lFQq7cw?}D(SsRfu%35CY*;^p|UjBJQon{RC27vn^xlVT?y&MIz3C7sa$3+a~0=O
z^EP`Y#$Q^NDnk<XU8_B1;aPvCL}LVdPJ6oiRfaphSLhK9d;&_q4~-(3>a7*qq!FXh
z5z$TzhNjf+ReTj`KrH<*A0`KhSubU;!EWE|!5!ajxC@cj>)#PPll*LqI5;;HFpSop
zdY1hpl?>uNe@TU+a5NuN87>EFXU!b`t<%|1juF^;EqvWR|2Ss=($sY~rk}e-Q<=wS
zH&=K1j3aT&H!2_UtOP2m@?S7{xO*4-2Y3_8<>A4@m6&^j+U?XNLD_FT|8PixWyuY8
zn-|_m9Fo>{qSiSvRTTf}@o~|wu?{w!d;k|>Zr!rmSw=MrJex8$+(3^>T~|pN?LnHz
zUc+3N=poEZ?W#$=p9W0qXw=vxB+$-H!nX^}n1=%)13v2QO^iG9M;GN8$rYwQTM<30
zkod&;X(=8{zj|7vy~#<9L<x{zTWtr-<Nbr(Yp0Eyc9eveV{?OrhAM?b2S}x!Q9ew&
z@X#5pGK9fm$<a%~VI`_k|L&N?N?+R}4)MCSPpIr!hNfLTTSe#mNq97gGO`3G*HLqB
z@rwgt#swcG93GiL)lGBlq5;fo8m`8UArqa5CSh+=F%VYhh6BK!%yi0d;!pNH7XlYV
z?ld7BW835|;S=x=ET+u{dS%6yG&sX`E(n_&w93%_9MD$(gVXI7NY>V-zYT<UWE!(*
zUk?-p7-JB&wx;4r)&v0LJ^V3h!6RhzQf)XFTb_mvs?5@TsEm09rqTe<oK*02VQ?fx
zhSq9R1Zl=LP#fOTnEQH1kKyj1?8o+=zb&Q;htk6Y>Mzi@3^%<$yPtV`9l~7-(?p78
zkd;-T(JdT?ZEG%NoaEqNnS+R>v1itbn`qQ2A=C2?w)s*;^iI{bbO9J9Od{19I(udq
z2_wUZcla@m<*mcX!(8tiCE`*#@GJ6{ruvge{@N-i6e#5REev0pt9HJV>P!d8TaQYW
zZD5Z&LLh(Uqj7PY4UPNajEL^EDt5$cFOM(gb{hU@te&9bio$mGOcru}Hr0wSO_m--
z81|qJ<Xp1=`iMAj3>*~>Gv1TntxW4gk32Tg>|14~d83Qbcux1v2(!m~+6*+TUrD!t
zqd9uTCOBQS)e?S~KQ5jorw58h5m@rCRe>CjuHF=<;3;2|we$}D@{FZqsZWbuNDdoy
zMru!Hs6X_+fLQy=f;6gK4S~WgG;Ie+b8bFYRIPzI*#)q)yG|mmpGVP4#s$?<!}1%O
za1w_C%-^?+lLYe=ez3$R3mTKv?+1}O-C02fKE%O20re7_6Dc+e?Q4wz4>u9oy117!
z@J60C)P&b9(UqJkpRv$Q3c0z@S-|Yx=Nw5yVvln0@gBJ@h&4QATT)P=W)Dl^i$un1
zE=>0-b?k-`JyQr0C1t70g%26VcWK&$*10j|FNi99gUTH9lXZ@|VI~6C&(>-WxtuU=
z*m|A<*-Nd7H+SCyxwy?aKizedbH*<mlLY_zLu(vy%?nyI%PT^}AZr~Yf4F_Ou&{{9
zho!S^t<SgFDnm_0(oNzd2|MXK^9eojfT-?OF`VF|0r%#bo{3CzcE42s$4glF!bhv#
zCaVd!p5}0m_uQ5S{a8;~zsh&U;TFAG+t$6R-axa;E;xQ1^LaPaGt3<$o*SU)s^_pM
zRNGf?PV{+U&<x?t2!Lz~{vVqb{tre6(}WkS1W|haXB!U)prwu2tj`t9rL?P;0y;Uq
zaNB(`*-@&(<7Q2+cPVLT1eA~G9jl$~Op4`0&fGP8H77{FwXRmX&v{!*Mzvw6kX+_J
zcC^uI_T-+pUG8CJowl^CI--amsdS=?q=Z%FToO%bwjxr4Jslg`{U1I&rT1-g20bu3
zvsZewG4_ctJZ(LVmM(m68N9w!6=VPjl8vjMjm%%J_f+gICenfKa(fGOaQ>0O;zphQ
zogO>_&}MqI7*09wQla+;QRdVz+L78(iRWUZ0u;cPk8I;7w>~4Dn!OQ1ZQ6ukB2h;~
zhF-%akxZ+rl$C2eekYAqnaisq)jBM=@2TRH=#lxTVN%}H)3KSJ>`?uxt(JrqhX}*K
z3)Rgvun9rumUg?=PRr_s;uu`1OHzPPRNec)@>RPistr88Ue9*TQOlZ?v5p0dEO9eD
z^abZ985g2~)CyO}GP!7;Sqn|1+udb0$J<uj#nI};8!#-;;U?X5b(rcHHRgpa$9Bkm
z8J<xvJ2>Hafy+mOQGu?ig)*O<DyRQsdU&`utR8<Z$NhY;g`*t*sTpQTxX)pXWn^;5
z+$13Y08F}Zxrjkg@1;5?qEqxMSMkVMczK4WI%*@<IJZsrc-?n<sw`mbQFctZ`F=Du
z$MJbVBa=(UvFj6U%`cnj?N=FpwR(lvK9z4Xl|GiXX6lo|YORaZ>5|cEp1KAf<p^}!
z@;iQ&J;@uArGQJycKkU3nI!_&Ick8f`pX_y5p(<P;UKJKhiB%c4^K_a!sR{m+!#h>
zgA)d!Uek%P=J2RS+WdT9O+vkll*=Pe{93n1vPXSZ2-Dlf*dMq89uQ)01QL-U{hoN|
z17PVJnQup!A`GOBF9`uPKBts}AjcU2ms#>bQwSM;+_H%6fVJuUJq!RXL=MdKlc)G+
zr;ew=x5<TcqqOQ_i_ZbapH`wkyT!a6UsZf5nF0*EKIw8)ONvZcdc1YaF8YhCd~_%{
zkAk1}*;+Iy9}#{I2&?D~6soBBy`T1t&{`a?lzn6DDK$@nGWO2u{%au{d2nx<PGwc?
z{N1|Jk51!Ufvj}UDK0lND~M-f1>6xWiN>f|0|U>_^M09>$|=*eU1%M3wIbmHaS0L(
z))lKG)_+Bb#X9L?)<ZxtsMcdr@vLs*RxjCW<b?q1zScz5DpP=YQ++Z>b(`ol;T;3q
zT?Q&en{LZDVKP$+Mc+7@t)~<NYDV9t3%x62=IiND#*tqmFmYS1adW6zl<&r%z#Bbi
z-e)S_sQBhomBwROD6gwOUg%&^GvO%0T$Ee9P?;!;&3`ah!*`l_<f1wCNhv33B`POf
ziki(Z{q1$H)h-~L=uaw?|GIJlZxqW3Lc#rmaJ|itI$Xs$no@y>n(fe!o&#lzwS#4#
z{S}$^FS|JL#H>7si4wCg7B<WiAw|uH_WF`Ybze+Ehb;zZmOz8<Gd}ZL<ww7l1gXE0
zzK?68J09R$4Au=CZgq(G60|kST@|H$!#`-PKQQqF&<RyQNR$6uJ)kjWxyj3KUoFoY
zQGC++l{JGV5goM%FQVR<y(&+JWV#1XRAS6S-}xqO+C&`A2JVI$fUN&jvyd6;f=O_w
ziRwTE^`;oLd%!Yo?9g*u%L~ZqLCB9#!v~gfC$*;VXE$cV#_a)81v3Z^KAr)d3_iSr
z0t?#RTGigxP3Noph--q>LO(1wQMiu&`IR=&Tcuj|*{D`he^zz^ZlimHz;t(e)P56t
zHXZ=T`BmFQuJ65c5*e2il5O<;yA~wd!UrnL24t*pYyQY-Q&KOBwvs%FcKu$?uX$gg
zs*NnkM!>EBj~Zb$Vzgox!AWS#tAv@Z04aYPB@rn(XJvG(@HQ6u)<cy_jNBeJJ{RL`
z&I{J{&nvT{MZ|O%6tJ=HwluG=Dk9-9W*$ZVsTCR<b8_q|{K&qx`YfuoHb+q4CZj{t
z(ffk^ce^~~#4dQ+waQh7Rb=h)&8cDzGgX^Hu0Jyt!n>l1=|b;$$`$IbnpPRc0v7Cl
zuSXp=8(5axJ0pX!W=8IDQa^RHxD&+ZT?!#2)z6SvK(|0Q*iv^$MyBSw?k{$GzLBf-
zKi|~GrfZWXjrD56=gd8I43QRdHXt~QLh!A=l3Ry3I_jdXyh)!NObkW<J?QX5+`WQ1
zga#kmz}Lm&xcR`gQRp{Ks+Ye2Ars%Uy}FzYR~4HXf}Gy^XRJ?}@RJ>EE^ednUq!L-
z0;RacOcyquO5PujLnk-&i7c(2R+Qn*=$|8q(bprwl?IXTErRz{)eINPj23_G%-qX`
z)j9nj$;k`jZs8zYhvk7LlGx=xk;E2I6c>ril<DqWHNqs<%&eNCG&_9|?`7IQiuDD4
z#r3<*lhxlRc^mzGwom{*5@^xMKXW@w1^_v3Cd4H3KSDd(1ZvM56mjI<OfhKxkhK}n
zo=(KS8wdYCX<O^>GaS(5i)F3<<>t|a6~T2j)z6{<#_)g>r?h4eol}{GM<;mT#cP!S
zB{ZvNmWjwz?j*MdY?xN!Z9`u;K}NOn;z~Mt4y;oErL<>QRE}SCvxex)l;P1|;KkG}
zTbEbgeVa*kt1rn{t}%x&q&<imC}5TI9BCMHebZ&V!XVR$L7o)hgh<dtK>{as`Qc?n
zU<-_`(>M#rOit=Ed6p@@Fb4ee<#-2-rZFJ_JvUWir+Ck*04>TIgwJz63B_KeZW~(8
zw;Zw6yLmmdVt3X?w~?1ll2o0*u|1s~Z9c!^8}5k%=T0&N><po<Q?v7~$dEjb$LWn9
z{#VK0<h|f1gqGj6q>fho)5=FQ)1BI3K?k<7!&Fqw7=a8u=Q009e?kvRwTmVl(<f4(
znz25}?qtGfYRZIOYYUSh%Qv$(U1e-cB<|H7dy*yatudaj0uth<nakzuNqGImgYq$d
z#_q3-0hT8G*BP8t?YnlUSo_y-h?K`gOvTTPtY1Btc1TvU3sAZccN9l%wLI@|Q2y0h
zuKnTZ_p{)NiG#pzqGOr@ZAG&;CTE=pAQ-*L6+prFE44)KCvSAY;h12i%HC2?S%wR<
zYZ=(ti;6^O<T-mYcUgJk+8{<CbU#@tvoMdO-vVQjMoyGQ29X;Wy`)kyvO>0Y;JMg1
z*z`>~!0f^Lq9+e9hFIH?1Pf>r6NY-l2^#+6Rs^`f*tq(93cALzKaUm#IyIz?7`xn$
z^0068HvB%lr;8xsxVrOTTmx^Ef@j&~!*pTBEExWX;YpgZip|A?4Y<C&G$cwT%{nhU
z2_COpe5;9%mmI7Rxx}}N)g`OJYR`$BU(wbHL!F|=F{&T6n!~<w@~oaJaL=H-le4_@
zRg~0HRg!WZ5;E+T;i0XWs8zO^J@|4^VYgq|hOnsjTO_A*G>x&K<}4CHKg-vzuxTAz
zF%e5N#bAC^#6V8mik!*F*XxDb!GydaA+Ndp-C`T23a}9wjWwNzd`DupHQ(8bg{Y|}
z<o98La?yhH;OzWXbSSZ~Zc56!7=|*Z%~mEh$jBUewMU)!W@)e<yTlu{JF+LQUX)op
zV^1-(f*MY76O2bG|27{N@d@N)I$urbC><e>a3~{SWVQ0!6In}jhZW+CeDf8&3n9>5
z0lj%?8iE}+wvcU4cHYJ0_;Ax-jFctva`FaGf1$@y_NY8<!DQtg^<|6B#HW3;o?t~4
zQv8jiu=zFG;?-a44WL*m2Jtd=?x4?feJ~-FD`r_Vj~{e@K;XN*u|#)fGwMLFIAN}G
z;-7&m!dO5@OBQUlYu3lfd2ElfTqe{!GBg(j3AH{f3$%oGM`EO18nNvtmPmG!CpXvE
zo}^wX`TSF=u1ATQ%v~w)Me8^Al7YX5U+=qf4!un!j2c0UG#Z()?t)-{z4lWSbcEp0
z`^@j`L`Qn7sOh-C#IHmfWgArTF7CbUFTL~`ZxC4?iDdYjam1TVS)mO<SMr;EldHJ+
z*TP7hVyhO2$F_)aF31t<z{J}9($SKf6j$30sQ%{V;6l<J5q_&{t5TPeWF=<N_6MI=
zMD%QQV^L$-^;1|FmQ%F|PCInv$v|ARP&>D^fG-Uu-*k-O5>p6HgBcNHb((}!;%Y5I
z4%`y<3pd#^pKtIsJq@VCmOs(YT=;EK2tyf-;S-}Z)!JpzI?452*sLi3MaJ^&(vzCm
zo*(sg_>;6iNvuvH&tDJv{FkcPweepG^a>(AB#)pyRF2Yr{LZ$W7U74BZlkSlhAeIi
z=28VilykS4>P;{RY6(B#YgzES#|pMs6e7*BlT{fpvoN$ajV^3rbgVy}2syNubX?z7
zDFE#9eS$>!>}S;r|6oY&!xq1}hR!hXGX`oay>p%28k2S#e5EQ54(e6QtCL{Sg<>pj
zVBT2vJW}wZn7wINAaRBZvI^3N_>nH3GSm{io0VUZ%n*ch;$ZSuiE{7^Cp>F&5*oMO
zhtU+I0!SK)xRlOXzb5iq?ihLMyT}X;G!T)67_oL!^#Y>bI+1$Ru*cSqB>faragNKV
z2{y|h&1}%r^^UN<Sr>|OxaJd41mKZfk@#p?#w<*SAEsjEn<`m`F-C<Bk>!99HVaKF
zU9{7H8(Ipk;tkh{KX$%F+WRk|y%<>G{$Kw*rLrKb-38yk%=D+-A2S0`Z8HYw(9vy{
zZyL;J2nOLWg<63I_k2txNRt44%P{b@YyrOYj0!E{?&V23%`ELYsX7si+V$aX;~jOP
zV>!XAXrV60eq1zOGtex!bIOjWch8?5+piSKw}A9;*z@r?7IA6*edzEfU|1*M`(+R}
z6S%o)oy@>1kX1?FV}_ITnH~Y9;D~ITBjXtUS5UJ_=kzl(@kr0_r_Iz8djxgkFfq*6
z0$E_iPp?*c<R{V9Gy*CHWGi)n^M3TE)_)cWV8`OHuzufrGZJ|8W_GQ@yFo%?XUune
y_hJ`oRv0;i{4f8=KYH{3-3<FP7XJJd7OP@dE6bWR@a>-mm{0O5a<ww1q5lS{z)z(B

literal 0
HcmV?d00001


From 619d75768e12574ebc6f81477306bf2b7e982389 Mon Sep 17 00:00:00 2001
From: Hamza Albreem <94292623+braim23@users.noreply.github.com>
Date: Thu, 20 Apr 2023 10:27:30 +0000
Subject: [PATCH 3/3] Tiny fix for the Security Headers doc

---
 docs/en/UI/AspNetCore/Security-Headers.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/en/UI/AspNetCore/Security-Headers.md b/docs/en/UI/AspNetCore/Security-Headers.md
index 7da95e1d73..8322644b1d 100644
--- a/docs/en/UI/AspNetCore/Security-Headers.md
+++ b/docs/en/UI/AspNetCore/Security-Headers.md
@@ -5,7 +5,7 @@ ABP Framework allows you to add frequently used security headers into your appli
 * `X-Content-Type-Options`: Tells the browser to not try and guess what a mime-type of a resource might be, and to just take what mime-type the server has returned.
 * `X-XSS-Protection`: This is a feature of Internet Explorer, Chrome, and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
 * `X-Frame-Options`: This header can be used to indicate whether or not a browser should be allowed to render a page in a `<iframe>` tag. By specifying this header value as *SAMEORIGIN*, you can make it displayed in a frame on the same origin as the page itself.
-* `Content-Security-Policy`: This response header allows you to restrict which resources (such as JavaScript, CSS, images, manifests, etc.) can be loaded, and the URLs that they can be loaded from. This security header only will be added if you configure the `AbpSecurityHeadersOptions` class and enable it.
+* `Content-Security-Policy`: This response header allows you to restrict which resources (such as JavaScript, CSS, images, manifests, etc.) can be loaded, and the URLs that they can be loaded from. This security header will only be added if you configure the `AbpSecurityHeadersOptions` class and enable it.
 
 ## Configuration
 
@@ -40,6 +40,6 @@ app.UseAbpSecurityHeaders();
 
 > You can add this middleware into the `OnApplicationInitialization` method of your module class to register it to the request pipeline. This middleware is already configured in the [ABP Commercial Startup Templates](https://docs.abp.io/en/commercial/latest/startup-templates/index), so you don't need to manually add it if you are using one of these startup templates.
 
-After, you have registered the `UseAbpSecurityHeaders` middleware into the request pipeline, the defined security headers will be shown in the response headers as in the figure:
+After that, you have registered the `UseAbpSecurityHeaders` middleware into the request pipeline, the defined security headers will be shown in the response headers as in the figure below:
 
-![](../../images/security-response-headers.png)
\ No newline at end of file
+![](../../images/security-response-headers.png)