title: When using both NWebSec.Mvc and NWebSec.OWIN, do I need to configue security in 2 places?
body: <p>I have an ASP.NET MVC 5 site that uses ASP.NET Identity v2. I'm trying to use <a href="https://github.com/NWebsec/NWebsec" rel="nofollow">NWebSec</a> to "harden" it.</p>
  
  <p>Because the site uses MVC and Owin, I've installed the NWebSec.MVC and NWebSec.OWIN NuGet packages.</p>
  
  <p>Reading the documentation, many of the options can be set for NWebSec/MVC via the config file, and some of the same options can be set for NWebSec.OWIN in code, via the Startup.cs file. </p>
  
  <p>For example, to add HSTS, I can do the following in web.config:</p>
  
  <pre><code>  &lt;nwebsec&gt;
      &lt;httpHeaderSecurityModule xmlns="http://nwebsec.com/HttpHeaderSecurityModuleConfig.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="NWebsecConfig/HttpHeaderSecurityModuleConfig.xsd"&gt;
        &lt;securityHttpHeaders&gt;
          &lt;strict-Transport-Security max-age="365" includeSubdomains="true" httpsOnly="false" preload="true" /&gt;
        &lt;/securityHttpHeaders&gt;
      &lt;/httpHeaderSecurityModule&gt;
    &lt;/nwebsec&gt;
  </code></pre>
  
  <p>...and/or the following in startup.cs:</p>
  
  <pre><code>    public void Configuration(IAppBuilder app)
      {
          this.ConfigureAuth(app);
  
          app.UseHsts(o =&gt; o.MaxAge(365).IncludeSubdomains().AllResponses().Preload());
      }
  </code></pre>
  
  <p><strong>My question is: do I have to set all the options in both places - or only in one place (in which case, which is better)?</strong> </p>
  
  <p>I'd prefer to do all the configuration in the web.config file, but I'm not sure whether this would miss out some things that need to be set in the Startup.cs file.</p>