From 62efc4917f39158ba530a9db14b4e55839596c8f Mon Sep 17 00:00:00 2001
From: Jean Gatto <jean_gatto@hotmail.com>
Date: Wed, 28 Aug 2024 14:15:11 -0300
Subject: [PATCH] feat: added secure headers middleware

Signed-off-by: Jean Gatto <jean_gatto@hotmail.com>
---
 Directory.Packages.props                 | 1 +
 requests.http                            | 4 ++--
 src/Shop.PublicApi/Program.cs            | 2 ++
 src/Shop.PublicApi/Shop.PublicApi.csproj | 1 +
 4 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 08be5ec..9480965 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -54,6 +54,7 @@
     <PackageVersion Include="MongoDB.Driver" Version="2.27.0" />
     <PackageVersion Include="NSubstitute" Version="5.1.0" />
     <PackageVersion Include="NSubstitute.Analyzers.CSharp" Version="1.0.17" />
+    <PackageVersion Include="OwaspHeaders.Core" Version="8.1.0" />
     <PackageVersion Include="Polly" Version="8.4.1" />
     <PackageVersion Include="Roslynator.Analyzers" Version="4.12.4" />
     <PackageVersion Include="Roslynator.CodeAnalysis.Analyzers" Version="4.12.4" />
diff --git a/requests.http b/requests.http
index f902c4b..549091a 100644
--- a/requests.http
+++ b/requests.http
@@ -1,6 +1,6 @@
 ### Register a new customer
 
-POST http://localhost:56344/api/customers HTTP/1.1
+POST http://localhost:56570/api/customers HTTP/1.1
 content-type: application/json
 
 {
@@ -13,5 +13,5 @@ content-type: application/json
 
 ### Gets a list of all customers
 
-GET http://localhost:56344/api/customers HTTP/1.1
+GET http://localhost:56570/api/customers HTTP/1.1
 content-type: application/json
\ No newline at end of file
diff --git a/src/Shop.PublicApi/Program.cs b/src/Shop.PublicApi/Program.cs
index 67861de..62d8dbf 100644
--- a/src/Shop.PublicApi/Program.cs
+++ b/src/Shop.PublicApi/Program.cs
@@ -14,6 +14,7 @@ using Microsoft.AspNetCore.ResponseCompression;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
+using OwaspHeaders.Core.Extensions;
 using Shop.Application;
 using Shop.Core;
 using Shop.Core.Extensions;
@@ -116,6 +117,7 @@ app.UseSwagger();
 app.UseSwaggerUI();
 app.UseResponseCompression();
 app.UseHttpsRedirection();
+app.UseSecureHeadersMiddleware();
 app.UseMiniProfiler();
 app.UseCorrelationId();
 app.UseAuthentication();
diff --git a/src/Shop.PublicApi/Shop.PublicApi.csproj b/src/Shop.PublicApi/Shop.PublicApi.csproj
index f4929b8..ccca8ab 100644
--- a/src/Shop.PublicApi/Shop.PublicApi.csproj
+++ b/src/Shop.PublicApi/Shop.PublicApi.csproj
@@ -39,6 +39,7 @@
     <PackageReference Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" />
     <PackageReference Include="MiniProfiler.AspNetCore.Mvc" />
     <PackageReference Include="MiniProfiler.EntityFrameworkCore" />
+    <PackageReference Include="OwaspHeaders.Core" />
     <PackageReference Include="Roslynator.Analyzers">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>