I’ve recently been asked by a colleague who wanted to know how they can score an A+ on www.securityheaders.com with a Windows Server 2019 AD FS WAP server that is exposed to the internet. It has been a while since I’ve configured one so I had to dig up my old notes and thought it would be great to write this quick post with the headers that achieves an A score. The reason why an A+ is not possible because it would require the Content-Security-Policy header to exclude the values:
- ‘unsafe-inline’
- ‘unsafe-eval’
… and excluding these would throw the following error:
JavaScript required
JavaScript is required. This web browser does not support JavaScript or JavaScript in this web browser is not enabled.
To find out if your web browser supports JavaScript or to enable JavaScript, see web browser help.
The following are the configuration for headers that I’ve used in the past to score an A (these are executed on the internal AD FS server and not on the WAP):
Set-AdfsResponseHeaders -SetHeaderName “Content-Security-Policy” -SetHeaderValue “default-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’; img-src ‘self’ “
Set-AdfsResponseHeaders -SetHeaderName “Strict-Transport-Security” -SetHeaderValue ” max-age=157680000; includeSubDomains”
Set-AdfsResponseHeaders -SetHeaderName “X-XSS-Protection” -SetHeaderValue “1;mode=block”
Set-AdfsResponseHeaders -SetHeaderName “X-Content-Type-Options” -SetHeaderValue “nosniff”
Set-AdfsResponseHeaders -SetHeaderName “Referrer-Policy” -SetHeaderValue “no-referrer”
Set-AdfsResponseHeaders -SetHeaderName “Permissions-Policy” -SetHeaderValue “geolocation=(),microphone=(),fullscreen=(self), vibrate=(self)”
Note that X-Frame-Options is already set to DENY by the AD FS server so there is no need to configure it. Use the following cmdlet to review the settings:
Get-AdfsResponseHeaders | Select-Object -ExpandProperty ResponseHeaders
Hope this helps anyone who may be looking for these headers.
