WEBVTT

00:00:01.767 --> 00:00:05.267
Let's quickly summarize this module. The

00:00:05.267 --> 00:00:08.267
browser is unsafe because it's very

00:00:08.267 --> 00:00:10.544
permissive. Luckily it has built-in

00:00:10.544 --> 00:00:14.267
features to make it safer. These light up

00:00:14.267 --> 00:00:16.966
when certain special HTTP security headers

00:00:16.966 --> 00:00:19.989
are used. Setting these headers can be

00:00:19.989 --> 00:00:24.167
done in ASP.NET Core by using filters or

00:00:24.167 --> 00:00:26.642
middleware. ASP.NET supports the same, but

00:00:26.642 --> 00:00:29.766
it also has the possibility to set the

00:00:29.766 --> 00:00:32.433
headers in the Web.config file. On top of

00:00:32.433 --> 00:00:35.367
that, you have also the possibility to use

00:00:35.367 --> 00:00:38.517
third-party NuGet packages. In the next

00:00:38.517 --> 00:00:40.909
module, we're taking a look at the

00:00:40.909 --> 00:00:43.195
cross-site scripting and clickjacking

00:00:43.195 --> 00:00:45.766
attacks and how to mitigate them by using

00:00:45.767 --> 00:00:50.767
the content security policy header and the

00:00:50.767 --> 00:00:53.767
x-frame options header.
