title: Content security policy header list protection using web.config in ASP.NET MVC
body: <p><a href="https://i.stack.imgur.com/LzRqh.png" rel="noreferrer">e.g. Image file Webconfig file which i manage in my project</a></p>
  
  <p><a href="https://i.stack.imgur.com/Myncp.png" rel="noreferrer">e.g. Image file of Issue facing for 404Javascript.js</a>
  I am facing the following Content Security Policy issue in my existing ASP.NET MVC project.</p>
  
  <p>We used <a href="https://sitecheck.sucuri.net/" rel="noreferrer">https://sitecheck.sucuri.net/</a> to check security scan </p>
  
  <blockquote>
    <p>Issue - Security Headers</p>
    
    <p>Missing security header for XSS Protection. Affected pages:</p>
    
    <p>Missing security header to prevent Content Type sniffing. Affected pages:</p>
    
    <p>Missing Strict-Transport-Security security header. Affected pages:</p>
    
    <p>Default server banners displayed. Your site is displaying your web server default banners. Affected pages:<br>
    <a href="https://www.example.com/404javascript.js" rel="noreferrer">https://www.example.com/404javascript.js</a><br>
    <a href="https://www.example.com/404testpage4525d2fdc" rel="noreferrer">https://www.example.com/404testpage4525d2fdc</a></p>
  </blockquote>
  
  <p>We are trying to resolve that using web config file with following configuration:</p>
  
  <pre><code>&lt;customHeaders&gt;
    &lt;remove name="X-Powered-By" /&gt;
    &lt;add name="X-Frame-Options" value="DENY" /&gt;
    &lt;add name="X-Xss-Protection" value="1; mode=block" /&gt;
    &lt;add name="X-Content-Type-Options" value="nosniff" /&gt;
    &lt;add name="Referrer-Policy" value="no-referrer" /&gt;
    &lt;add name="X-Permitted-Cross-Domain-Policies" value="none" /&gt;
    &lt;add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" /&gt;
    &lt;add name="Feature-Policy" value="accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'" /&gt;
  &lt;/customHeaders&gt;
  
  &lt;httpRuntime targetFramework="4.6.1" maxRequestLength="1048576"  
               requestValidationMode="4.0" executionTimeout="110" 
               enableVersionHeader="false" /&gt;
  </code></pre>
  
  <p>But we are still facing same issue after changing configuration, please look at our process where we are wrong or any alternate solution.</p>