Security Configuration
Security headers, request limits, Data Protection, domain policy
Security Configuration
uTPro includes built-in security hardening. Most is code-level (in Startup/*.cs), while HTTP security headers are content-driven from the backoffice.
Security Headers (backoffice-driven)
Security headers are read from a GlobalSecurityHeadersSettings node. Sensible defaults fill in any field left blank.
| Field | Header | Default |
|---|---|---|
| Enabled | (master toggle) | — |
| XContentTypeOptions | X-Content-Type-Options | nosniff |
| XFrameOptions | X-Frame-Options | SAMEORIGIN |
| ContentSecurityPolicyCsp | Content-Security-Policy | (omitted) |
| HstsEnabled | Strict-Transport-Security | false |
| HstsMaxAgeSeconds | max-age | 31536000 (1 year) |
Other Security Features
- Request Size Limits: 128MB max upload, 4MB per form value
- Sync IO disabled: Both IIS and Kestrel have AllowSynchronousIO = false
- Data Protection: Keys persisted with 90-day rotation
- Domain Policy: Domain allowlist with wildcard support in CheckPolicy.cs
- Kestrel: Server header disabled
- Header-injection safe: Values collapsed to single line before emitting
- Fails open: If settings lookup errors, request served with no security headers (warning logged)
