Question

我已经对Linux上Azure Webapp网站上托管的应用程序进行了反应。它使用茶est作为Web服务器。我想将安全标题添加到Web应用程序。但是我为此添加的Web.config文件没有显示更改。

我尝试通过在Azure Windows Web应用程序上创建另一个Web应用程序并更新Web.config文件来进行同样的操作，如下所示：添加了安全标头。

但是对于Azure Linux Webapp，此文件不起作用。

我正在使用的Web.config文件。

    <?xml version="1.0" encoding="UTF-8"?>
<configuration>  
    <system.web>
        <httpRuntime enableVersionHeader="false" />
    </system.web>
    <system.webServer>        
        <!-- START x-xss protection -->
        <httpProtocol>
            <customHeaders>
                    <!-- Protects against Clickjacking attacks. ref.: http://stackoverflow.com/a/22105445/1233379 -->
                  <add name="X-Frame-Options" value="SAMEORIGIN" />
                  <!-- Protects against Clickjacking attacks. ref.: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet -->
                  <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains"/>
                  <!-- Protects against XSS injections. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
                  <add name="X-XSS-Protection" value="1; mode=block" />
                  <!-- Protects against MIME-type confusion attack. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
                  <add name="X-Content-Type-Options" value="nosniff" />
                  <!-- CSP modern XSS directive-based defence, used since 2014. ref.: http://content-security-policy.com/ -->
                  <add name="Content-Security-Policy" value="default-src 'self'; font-src *;img-src * data:; script-src *; style-src *;" />
                  <!-- Prevents from leaking referrer data over insecure connections. ref.: https://scotthelme.co.uk/a-new-security-header-referrer-policy/ -->
                  <add name="Referrer-Policy" value="strict-origin" />
                  <add name="Feature-Policy" value="accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'" />
                  <remove name="X-Powered-By" />                          
            </customHeaders>
        </httpProtocol>
        <!-- END x-xss protection -->
        <rewrite>
            <rules>
                <!-- BEGIN rule TAG FOR HTTPS REDIRECT -->
                <rule name="Force HTTPS" enabled="true">
                  <match url="(.*)" ignoreCase="false" />
                  <conditions>
                    <add input="{HTTPS}" pattern="off" />
                  </conditions>
                  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />
                </rule>
                <!-- END rule TAG FOR HTTPS REDIRECT -->       
            </rules>
            <outboundRules>
            <rule name="Add Strict-Transport-Security only when using HTTPS" enabled="true">
              <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
              <conditions>
                <add input="{HTTPS}" pattern="on" ignoreCase="true" />
              </conditions>
              <action type="Rewrite" value="max-age=31536000; includeSubdomains; preload" />
            </rule>
            <rule name="CSP">
              <match serverVariable="RESPONSE_Content-Security-Policy" pattern=".*" />
            </rule>
            </outboundRules>
        </rewrite>        
    </system.webServer>
</configuration>

Answer 1

在Linux WebApp上，您必须使用.htaccess config，它与Web.config有点不同，但是允许您设置类似的设置。 Web.config仅在基于IIS / Windows的环境中使用。

使用Kestrel的Linux上的Azure Webapp网站未获取Web.config更改

1 个答案: