Royal Apps

Some Security Scanners require specific HTTP Headers to be present in the response of Royal Server.

Here are some headers with example values that can be configured:

• Strict-Transport-Security: nosniff
• X-Content-Type-Options: maxage:315360000
• Cache-Control: no-cache, no-store
• X-XSS-Protection: 1
• Content-Security-Policy: default-src

This can be achieved with the following configuration steps:

1. Make a backup of the configuration file at %programdata%\RoyalServer\appsettings.json
2. Edit the Royal Server configuration file at %programdata%\RoyalServer\appsettings.json
3. Look for the line

4. "CustomHeaders": [],

5. and replace this line with the following information:

6. "CustomHeaders": [
           {
               "Name": "X-Content-Type-Options",
               "Value": "nosniff",
               "Disabled": false
           },
           {
               "Name": "Strict-Transport-Security",
               "Value": "max-age=31536000",
               "Disabled": false
           },
                   {
               "Name": "Cache-Control",
               "Value": "no-cache, no-store",
               "Disabled": false
           },
           {
               "Name": "X-XSS-Protection",
               "Value": "1",
               "Disabled": false
           },
           {
               "Name": "Content-Security-Policy",
               "Value": "default-src",
               "Disabled": false
           }
       ],
   
   

Note:

Some security scanner products require the Cache-Control to something like private,max-age=31536000. 

For the request /authentication/signin (which is automatically redirected to if not logged in) asp.net core resets to no-cache, no-store since this request must not be cached in any circumstances.

For details see this information from Microsoft:

https://learn.microsoft.com/en-us/aspnet/core/performance/caching/middleware?view=aspnetcore-8.0#conditions-for-caching