====== Azure Web App Security Hardening ====== A bunch of checks can be done [[https://securityheaders.io/|here]]. ===== HTTPS Only ===== ''~/App_Start/FilterConfig.cs'':


public static void RegisterGlobalFilters(GlobalFilterCollection filters) {
    // Add this:
    filters.Add(new RequireHttpsAttribute());

===== Remove Unnecessary Headers ===== ''~/Global.asax.cs'':


protected void Application_Start() {
	...
	// Add this:
	MvcHandler.DisableMvcResponseHeader = true;
}

// Add this method:    
protected void Application_PreSendRequestHeaders(object sender, EventArgs e) {
	// Trying to remove this in the web.config doesn't work for some reason...
	Response.Headers.Remove("server");
}

''~/Web.config'':



	...
	
	
	...

...

===== HTTPS Only Cookies ===== ''~/Web.config'':

...

===== Add Security Headers ===== ''~/Web.config'':

...