0

I'm working on a .net core app and I'm implementing the security headers like HttpOnly, CSP and Referrer.

My question is, we are on GCP and have a lb.tf (Load Balancer terraform file) do I have to make any changes to this file or are security headers only implemented at the app level?

      app.Use((context, next) =>
      {
        context.Response.Headers.Add("Referrer-Policy", "no-referrer");
        context.Response.Headers.Add("Content-Security-Policy", "default-src 'self'");
        return next();
      });

      app.UseCookiePolicy(new CookiePolicyOptions
      {
        Secure = Microsoft.AspNetCore.Http.CookieSecurePolicy.Always,
        HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.Always
      });

I have the implementation working on the app level by adding the security headers to my startup.cs file but I've been reading about lb.tf and I can't find anything related to security headers implementation.

0 Answers0