umbraco-security-headers
Installation
SKILL.md
Security Headers
Two supported ways to send a CSP and the other security headers:
| A — Custom middleware (default) | B — NWebsec | |
|---|---|---|
| Reference | approach-a-middleware.md | approach-b-nwebsec.md |
| Source | Verified code in assets/ |
The docs' NWebsec sample, scoped per surface |
| Dependencies | None | NWebsec.AspNetCore.Middleware |
| Wiring | A composer adds it to Umbraco's pipeline | Program.cs, before app.UseUmbraco() |
| Best for | New CSP work, packages, sites without NWebsec | Sites that already use NWebsec |
How to decide
Default to A. Choose B when the project already configures headers with NWebsec: extend that setup rather than adding a second source of the same headers. Never run both.
Before writing any code, open the reference for the approach you choose, and for A start from
the files in assets/. The steps, and the order the headers must be set in, are only there.