SitecoreSecurity/configurehttpheaders.xdt at master · BasLijten/SitecoreSecurity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.web>
    <httpRuntime xdt:Transform="SetAttributes(enableVersionHeader)" enableVersionHeader="false" >
    </httpRuntime>
  </system.web>
  <system.webServer>
  <rewrite xdt:Transform="InsertIfMissing">
            <rules xdt:Transform="InsertIfMissing">
                <rule name="Http Redirect to HTTPS" enabled="true" stopProcessing="true" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)">
                    <match url="(.*)" ignoreCase="true" />
          <conditions logicalGrouping="MatchAll">
                        <add input="{HTTPS}" pattern="off" />
                        <add input="{HTTP_HOST}" pattern="insurco.baslijten.com" />
          </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />
                </rule>
            </rules>
      <outboundRules xdt:Transform="InsertIfMissing">
                <rule name="Add Strict-Transport-Security when HTTPS" enabled="true" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)">
                    <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
                    <conditions>
                        <add input="{HTTPS}" pattern="on" />
                        <add input="{HTTP_HOST}" pattern="insurco.baslijten.com" />
                    </conditions>
                    <action type="Rewrite" value="max-age=31536000" />
                </rule>
                <rule name="RESPONSE_SERVER" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)">
                    <match serverVariable="RESPONSE_SERVER" pattern=".*" />
                    <action type="Rewrite" value="" />
                </rule>
            </outboundRules>
        </rewrite>
    <httpProtocol xdt:Transform="InsertIfMissing">
      <customHeaders xdt:Transform="InsertIfMissing">
                <remove name="X-Powered-By" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)"/>
        <Add name="X-Content-Type-Options" Value="nosniff" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)"/>
      </customHeaders>
    </httpProtocol>
  </system.webServer>

</configuration>