Fixing disabled security features

Adding layers of defense and protection helps an ASP.NET Core web application from getting exploited. Web application servers have built-in security features such as security headers configured to be sent as a part of the HTTP response back to the client, instructing browsers to enable the security mechanism. Not all of these security headers are turned on or added by default, so enabling it in code is left in the web developers' hands.

In this recipe, we are going to add the missing HTTP security headers to enable protection in our sample Online Banking app.

Getting ready

We will use the Online Banking app we used in the previous recipe. Using Visual Studio Code, open the sample Online Banking app folder at \Chapter07\disabled-security-features\before\OnlineBankingApp\.

You can perform the steps in this folder to fix the missing security features in this recipe.

How to do it…

Let's take a look at the steps for this...