带有 Kestrel 的 Linux 上的 Azure Webapp 网站未获取 Web.config 更改

Question

我在 Linux 上的 Azure Webapp 网站上托管了 React 应用程序。它使用 kestrel 作为 Web 服务器。我想将安全标头添加到 webapp。但是我为此添加的 Web.config 文件没有显示更改。

我通过在 Azure Windows Webapp 上创建另一个 Web 应用程序来尝试相同的方法，并在添加安全标头时更新 Web.config 文件，如下所示。

但对于 Azure Linux Webapp，此文件不起作用。

我正在使用的 Web.config 文件。

    <?xml version="1.0" encoding="UTF-8"?>
<configuration>  
    <system.web>
        <httpRuntime enableVersionHeader="false" />
    </system.web>
    <system.webServer>        
        <!-- START x-xss protection -->
        <httpProtocol>
            <customHeaders>
                    <!-- Protects against Clickjacking attacks. ref.: http://stackoverflow.com/a/22105445/1233379 -->
                  <add name="X-Frame-Options" value="SAMEORIGIN" />
                  <!-- Protects against Clickjacking attacks. ref.: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet -->
                  <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains"/>
                  <!-- Protects against XSS injections. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
                  <add name="X-XSS-Protection" value="1; mode=block" />
                  <!-- Protects against MIME-type confusion attack. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
                  <add name="X-Content-Type-Options" value="nosniff" />
                  <!-- CSP modern XSS directive-based defence, used since 2014. ref.: http://content-security-policy.com/ -->
                  <add name="Content-Security-Policy" value="default-src 'self'; font-src *;img-src * data:; script-src *; style-src *;" />
                  <!-- Prevents from leaking referrer data over insecure connections. ref.: https://scotthelme.co.uk/a-new-security-header-referrer-policy/ -->
                  <add name="Referrer-Policy" value="strict-origin" />
                  <add name="Feature-Policy" value="accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'" />
                  <remove name="X-Powered-By" />                          
            </customHeaders>
        </httpProtocol>
        <!-- END x-xss protection -->
        <rewrite>
            <rules>
                <!-- BEGIN rule TAG FOR HTTPS REDIRECT -->
                <rule name="Force HTTPS" enabled="true">
                  <match url="(.*)" ignoreCase="false" />
                  <conditions>
                    <add input="{HTTPS}" pattern="off" />
                  </conditions>
                  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />
                </rule>
                <!-- END rule TAG FOR HTTPS REDIRECT -->       
            </rules>
            <outboundRules>
            <rule name="Add Strict-Transport-Security only when using HTTPS" enabled="true">
              <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
              <conditions>
                <add input="{HTTPS}" pattern="on" ignoreCase="true" />
              </conditions>
              <action type="Rewrite" value="max-age=31536000; includeSubdomains; preload" />
            </rule>
            <rule name="CSP">
              <match serverVariable="RESPONSE_Content-Security-Policy" pattern=".*" />
            </rule>
            </outboundRules>
        </rewrite>        
    </system.webServer>
</configuration>

Answer 1

在 Linux WebApp 上，您必须使用 .htaccess 配置，这与 Web.config 有点不同，但允许您设置类似的设置。 Web.config 仅在基于 IIS/Windows 的环境中使用。