Piranha middleware breaks response headers.

[Neutrino-Sunset]

This initialization code correctly adds the specified security headers to all responses.

var builder = WebApplication.CreateBuilder(args);
builder.WebHost.UseKestrel(option => option.AddServerHeader = false);
builder.Services.AddRazorPages();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
   app.UseExceptionHandler("/Error");
   app.UseHsts();
}

app.UseHttpsRedirection();

app.Use(async (context, next) =>
{
   context.Response.Headers.Add("Content-Security-Policy", "default-src 'self';");
   context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");
   context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
   context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
   await next.Invoke();
});

app.UseStaticFiles();
app.UseRouting();
app.UseAuthorization();
app.MapRazorPages();

app.Run();

This same code with minimal Piranha initialization code does not work. The security headers are correctly added for page requests, but for all other requests (e.g. css, scripts, images and all other resources) the headers are not added.

var builder = WebApplication.CreateBuilder(args);

builder.AddPiranha(options =>
{
   options.UseCms();
   options.UseFileStorage(naming: Piranha.Local.FileStorageNaming.UniqueFolderNames);
   options.UseEF<SQLiteDb>(db =>
       db.UseSqlite("Filename=./PiranhaWeb.db"));
});

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
   app.UseExceptionHandler("/Error");
   app.UseHsts();
}

app.UseHttpsRedirection();

app.Use(async (context, next) =>
{
   context.Response.Headers.Add("Content-Security-Policy", "default-src 'self';");
   context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");
   context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
   context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
   await next.Invoke();
});

app.MapRazorPages();

app.UsePiranha(options =>
{
   App.Init(options.Api);
});

app.Run();

Seems like a bug to me.

Full working repo here

[vjacquet]

My guess is that the problem is within options.UseCms() because it registers PiranhaStartupFilter

piranha.core/core/Piranha.AspNetCore/Extensions/PiranhaStartupExtensions.cs

Line 54 in 32fb288

serviceBuilder.Services.AddTransient<IStartupFilter, PiranhaStartupFilter>();

that calls the static file middleware at the beginning of the pipeline, so it runs before your own middleware.

piranha.core/core/Piranha.AspNetCore/Hosting/PiranhaStartupFilter.cs

Lines 32 to 37 in 32fb288

	builder
	.UseSecurityMiddleware()
	.UseStaticFiles()
	.UseMiddleware<RoutingMiddleware>()
	.UseMiddleware<SitemapMiddleware>();
	next(builder);

May be you could try and implement you own IStartupFilter and register it in the services before piranha's.

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddTransient<IStartupFilter, MySecurityStartupFilter>();
builder.AddPiranha(options =>
{
   options.UseCms();
   ...

Where MySecurityStartupFilter is

    class MySecurityStartupFilter  : IStartupFilter
    {
        public Action<IApplicationBuilder> Configure(Action<IApplicationBuilder> next)
        {
            return builder =>
            {
                builder.Use(async (context, next) =>
                {
                    context.Response.Headers.Add("Content-Security-Policy", "default-src 'self';");
                    context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");
                    context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
                    context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
                    await next.Invoke();
                });
                next(builder);
            };
        }
    }