Headers applied to GET only?

[lanorkin]

Looking at code

Stott.Security.Optimizely/src/Stott.Security.Optimizely/Features/Middleware/SecurityHeaderMiddleware.cs

Line 31 in 8f9248c

if (string.Equals(context.Request.Method, HttpMethods.Get, StringComparison.OrdinalIgnoreCase))

I see that headers applied to GET methods ONLY - so say POST to any URL will never return Strict-Transport-Security header etc.

Is it intended, or is it a bug?

I see related #82 for this change (change to apply "all GET" instead of "any page request"), but don't see a reason to not include security headers for other HTTP methods.

[GeekInTheNorth]

Hello @lanorkin,

There was a point in time where the module was altered to apply the CSP to all GET routes instead of just to routes which covered a Content Page route. This change was made to ensure that the CSP was also applied to the Editor and Admin interface. As the initial page load already instructs the browser for the CSP and the browser would cache the Strict-Transport-Security header, this was switched to a GET method check.

In retrospect, with the other headers in mind (and recent caching and performance boosts) it may be prudent to change this to apply for both GET and POST methods on the basis that you may reach a content page on a POST method just as easily as a GET page. It may also be prudent to apply this to any HTTP Method if your Controller Actions do not have the specific methods restricted.

If you agree with the proposed change to apply this for all HTTP methods, I'll promote this to a bug and make the necessary changes.

Regards,
Mark

[lanorkin]

Hi @GeekInTheNorth yes, I think then in this case it should be a bug to fix - I think it is fair expectation to see security headers for all the methods. Thanks a lot!

[GeekInTheNorth]

Hello @lanorkin

I've raised this now as #218

I have some other amends mid flight which are not ready for release yet, so I'll tackle this one as if it were a hotfix and release it separately when it's done. I'll let you know when it's on the NuGet feeds.

[GeekInTheNorth]

Released in Release 2.7.0, see #228