You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Configure security headers with Azure Front Door Standard/Premium Rule Set
3
-
description: This article provides guidance on how to use rule set to configure security headers.
2
+
title: Configure security headers with Standard/Premium Rule Set
3
+
titleSuffix: Azure Front Door
4
+
description: Learn how to use Azure Front Door Standard/Premium rule sets to configure security headers and prevent browser-based vulnerabilities..
4
5
services: frontdoor
5
6
author: duongau
6
7
ms.service: azure-frontdoor
7
8
ms.topic: how-to
8
-
ms.date: 02/24/2025
9
+
ms.date: 02/25/2025
9
10
ms.author: yuajia
10
11
---
11
12
@@ -17,8 +18,9 @@ The following example shows you how to add a Content-Security-Policy header to a
17
18
18
19
## Prerequisites
19
20
20
-
* Before you can configure security headers, you must first create a Front Door. For more information, see [Quickstart: Create a Front Door](create-front-door-portal.md).
21
-
* Review how to [Set up a Rule Set](how-to-configure-rule-set.md) if you haven't used the Rule Set feature before.
21
+
- Azure Front Door. For more information, see [Quickstart: Create a Front Door](create-front-door-portal.md).
22
+
23
+
- Review how to [Set up a Rule Set](how-to-configure-rule-set.md) if you're new to the Rule Set feature.
22
24
23
25
## Add a Content-Security-Policy header in Azure portal
24
26
@@ -28,15 +30,15 @@ The following example shows you how to add a Content-Security-Policy header to a
28
30
29
31
1. Set the operator to **Append** to add this header as a response to all of the incoming requests for this route.
30
32
31
-
1. Add the header name: **Content-Security-Policy** and define the values this header should accept. In this scenario, we choose *"script-src 'self' https://contoso.azure-api.net"*.
33
+
1. Add the header name: **Content-Security-Policy** and define the values this header should accept. In this scenario, we choose `"script-src 'self' https://contoso.azure-api.net"`.
32
34
33
-
1.Once you've added all of the rules you'd like to your configuration, don't forget to associate the rule set with a route. This step is *required* to allow the rule set to take action.
35
+
1.After adding all the rules you want to your configuration, remember to associate the rule set with a route. This step is **required** for the rule set to take action.
34
36
35
37
> [!NOTE]
36
-
> In this scenario, we did not add [match conditions](concept-rule-set-match-conditions.md) to the rule. All incoming requests that match the path defined in the associated route will have this rule applied. If you would like it to only apply to a subset of those requests, be sure to add your specific **match conditions** to this rule.
38
+
> In this scenario, we didn't add [match conditions](concept-rule-set-match-conditions.md) to the rule. All incoming requests that match the path defined in the associated route have this rule applied. To apply it only to a subset of those requests, add your specific **match conditions** to this rule.
37
39
38
-
> [!NOTE]
39
-
> If you are using Web Application Firewall (WAF) with your Azure Front Door, and the WAF blocks a request, HSTS headers will not be added to the request even if they are enabled on the Azure Front Door.
40
+
> [!IMPORTANT]
41
+
> If you're using Web Application Firewall (WAF) with your Azure Front Door, and it blocks a request, HSTS headers won't be added to the request even if they're enabled on the Azure Front Door.
40
42
41
43
## Clean up resources
42
44
@@ -46,8 +48,11 @@ In the preceding steps, you configured Content-Security-Policy header with Rule
46
48
47
49
### Deleting a Rule Set
48
50
49
-
If you want to delete a Rule Set, make sure you disassociate it from all routes before deleting. For detailed guidance on deleting a rule set, refer to [Configure your rule set](how-to-configure-rule-set.md).
51
+
If you want to delete a Rule Set, make sure you disassociate it from all routes before deleting. For detailed guidance on deleting a rule set, see [Configure your rule set](how-to-configure-rule-set.md).
52
+
53
+
## Next step
50
54
51
-
## Next steps
55
+
To learn how to configure a Web Application Firewall for your Front Door, see:
52
56
53
-
To learn how to configure a Web Application Firewall for your Front Door, see [Web Application Firewall and Front Door](../../web-application-firewall/afds/afds-overview.md).
57
+
> [!div class="nextstepaction"]
58
+
> [Web Application Firewall and Front Door](../../web-application-firewall/afds/afds-overview.md)
0 commit comments