---
title: Web Security Configuration and Defaults
slug: web-security-configuration-and-defaults
docTags: 
createdAt: 2025-11-03T21:36:45.282Z
---

Activate implements a layered security model to protect all data, sessions, and communication channels.
This document details the default web security configuration applied across all Activate installations.

# HTTPS Enforcement

All communication with Activate must occur over a secure HTTPS connection.
Any HTTP request is automatically redirected to HTTPS to maintain confidentiality and integrity.

# Cookie Security

All cookies used by Activate include the following protections:

- **SameSite** restriction to prevent cross-site data leakage
- **Secure** flag to enforce HTTPS-only transmission
- **HttpOnly** flag to block client-side access

# Content Security Policy (CSP)

A strict **Content Security Policy** prevents unauthorised scripts and content injection.
It also blocks the site from being embedded in iframes, mitigating clickjacking attacks.

The configuration file is located at:
`//Resources/Configuration/Web/ContentSecurityPolicy`

:::hint{type="info"}
For guidance on adjusting CSP settings, refer to the [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html).
Altering default directives may cause functionality issues.
:::

# Cross-Site Scripting (XSS)

All dynamic content and user input are validated and encoded by the .NET framework to prevent XSS attacks.
Activate sanitises and encodes user-supplied data before rendering it in the web interface.

# Cross-Site Request Forgery (CSRF)

Activate includes a built-in anti-forgery framework based on .NET 8 
This protection applies to both **Forms** and **Windows Authentication** logons, ensuring that requests cannot be forged from an untrusted origin.

For further information, see [Microsoft Anti-Request Forgery Documentation](https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery).

# Secure Headers

The following HTTP headers are included in all installations to enforce modern browser security standards:

```xml
<add name="X-Content-Type-Options" value="nosniff" />
<add name="X-Frame-Options" value="DENY" />
<add name="X-Permitted-Cross-Domain-Policies" value="master-only" />
<add name="X-XSS-Protection" value="0" />
```