Content security policy header list using web config file

Question

I am Facing following Content Security Policy issue in my existing mvc project. We used https://sitecheck.sucuri.net/ to check security scan Issue - Security Headers Missing security header for XSS Protection. Affected pages: Missing security header to prevent Content Type sniffing. Affected pages: Missing Strict-Transport-Security security header. Affected pages: Default server banners displayed. Your site is displaying your web server default banners. Affected pages: https://www.example.com/404javascript.js https://www.example.com/404testpage4525d2fdc We are trying to resolve that using web config file with following configuration: ` ` But we are still facing same issue after changing configuration, please look at our process where we are wrong or any alternate solution.

Bidyasagar Mishra · Accepted Answer

system.webServer >         httpProtocol >             customHeaders >                 add   name = "Content-Security-Policy"   value = "default-src 'self';"   />             customHeaders >         httpProtocol >    system.webServer >

Bidyasagar Mishra · Answer

Hi sfx wall, Follow the below link for get the solution.  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

sfx wall · Answer

Hi Bidyasagar Mishra, Thankx for the solution, i have puted it in my application it resolved some issue but i am getting this, can you please help me out ASAP.   Missing security header for XSS Protection. Affected pages: https://www.example.com/404javascript.js https://www.example.com/404testpage4525d2fdc Missing security header to prevent Content Type sniffing. Affected pages: https://www.example.com/404javascript.js https://www.example.com/404testpage4525d2fdc Missing Strict-Transport-Security security header. Affected pages: https://www.example.com/404javascript.js https://www.example.com/404testpage4525d2fdc Default server banners displayed. Your site is displaying your web server default banners. Affected pages: https://www.example.com/404javascript.js https://www.example.com/404testpage4525d2fdc