Security headers & csp

As a one man army, I don't have the experts around me to drop some request and trust things will be done. And as I am not a developer, there are a ton of things that take quite a bit of time. So, everything I learn, I write down in my support system. But this time, it seems a topic that can be helpful to others too: security headers and content security policy. 

One of the key features of DNN is security. We can sleep at night, knowing that our cms is pretty well built. But besides a great application we need some more stuff to keep enemies out. We have firewalls, tell our customers to use strong passwords and last couple of years secure logging in using SSL certificates has become the default standard.

Security is doing a lot of small things right. And I like to bring 2 topics to your attention that will become mainstream as well. : security headers and content security policy. Often, they are mentioned in one sentence. They both try to battle attacks like cross site scripting and both determine what is allowed from othe websites. But you can actually implement 1 at a time. 

I have written down my findings in the wiki. Including sample code, where to put it, how to test and what problems you might run into.

• https://www.dnnsoftware.com/wiki/content-security-policy-amp-dnn
• https://www.dnnsoftware.com/wiki/security-headers-amp-dnn