Merge branch 'master' into 253-add-author-name-in-blog-post

Author: Arnab-Developer

Directory.Packages.props

@@ -29,9 +29,10 @@
     <PackageVersion Include="Markdig" Version="0.41.3" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="9.0.8" />
     <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.8" />
-    <PackageVersion Include="NCronJob" Version="4.5.4" />
+    <PackageVersion Include="NCronJob" Version="4.6.0" />
     <PackageVersion Include="ReverseMarkdown" Version="4.7.0" />
     <PackageVersion Include="System.ServiceModel.Syndication" Version="9.0.8" />
+		<PackageVersion Include="NetEscapades.AspNetCore.SecurityHeaders" Version="1.1.0"/>
   </ItemGroup>
   <ItemGroup Label="Tests">
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.8" />
@@ -54,6 +55,6 @@
   </ItemGroup>
   <ItemGroup Label="Tools">
     <PackageVersion Include="CommandLineParser" Version="2.9.1" />
-    <PackageVersion Include="Microsoft.Playwright" Version="1.54.0" />
+    <PackageVersion Include="Microsoft.Playwright" Version="1.55.0" />
   </ItemGroup>
 </Project>

src/LinkDotNet.Blog.Web/LinkDotNet.Blog.Web.csproj

@@ -19,6 +19,7 @@
 			<PrivateAssets>all</PrivateAssets>
 		</PackageReference>
 		<PackageReference Include="Microsoft.Extensions.Options"/>
+		<PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders"/>
 		<PackageReference Include="ReverseMarkdown"/>
 		<PackageReference Include="System.ServiceModel.Syndication"/>
 	</ItemGroup>

src/LinkDotNet.Blog.Web/Program.cs

@@ -6,6 +6,7 @@
 using LinkDotNet.Blog.Web.RegistrationExtensions;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Diagnostics.HealthChecks;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 
 namespace LinkDotNet.Blog.Web;
@@ -25,6 +26,18 @@ public static async Task Main(string[] args)
 
     private static void RegisterServices(WebApplicationBuilder builder)
     {
+        builder.Services.AddSecurityHeaderPolicies()
+            .SetDefaultPolicy(p =>
+                p.AddDefaultSecurityHeaders()
+                    .AddCrossOriginEmbedderPolicy(policy => policy.UnsafeNone())
+                    .AddPermissionsPolicy(policy =>
+                    {
+                        policy.AddCamera().None();
+                        policy.AddMicrophone().None();
+                        policy.AddGeolocation().None();
+                    }))
+            .AddPolicy("API", p => p.AddDefaultApiSecurityHeaders());
+
         builder.Services
             .AddHostingServices()
             .AddConfiguration()
@@ -49,6 +62,8 @@ private static void RegisterServices(WebApplicationBuilder builder)
 
     private static void ConfigureApp(WebApplication app)
     {
+        app.UseSecurityHeaders();
+
         if (app.Environment.IsDevelopment())
         {
             app.UseDeveloperExceptionPage();