Updated packages and fixed breaking changes (#482)

* Updated packages and fixed breaking changes * Added null check for header value
DFE-Digital · Dec 4, 2024 · 0762ae2 · 0762ae2
1 parent d6ec706
commit 0762ae2
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 9 deletions.
diff --git a/src/Dfe.EarlyYearsQualification.Web/Dfe.EarlyYearsQualification.Web.csproj b/src/Dfe.EarlyYearsQualification.Web/Dfe.EarlyYearsQualification.Web.csproj
@@ -17,7 +17,7 @@
       <PackageReference Include="jQuery" Version="3.7.1" />
       <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.22.0" />
       <PackageReference Include="moq" Version="4.20.72" />
-      <PackageReference Include="OwaspHeaders.Core" Version="9.1.1" />
+      <PackageReference Include="OwaspHeaders.Core" Version="9.4.0" />
       <PackageReference Include="RobotsTxtCore" Version="3.0.0" />
     </ItemGroup>
 

diff --git a/src/Dfe.EarlyYearsQualification.Web/Security/SecureHeaderConfiguration.cs b/src/Dfe.EarlyYearsQualification.Web/Security/SecureHeaderConfiguration.cs
@@ -14,11 +14,10 @@ public static SecureHeadersMiddlewareConfiguration CustomConfiguration()
                             .UseHsts()
                             .UseXFrameOptions()
                             .UseContentTypeOptions()
-                            .UseContentDefaultSecurityPolicy()
+                            .UseDefaultContentSecurityPolicy()
                             .UsePermittedCrossDomainPolicies()
                             .UseReferrerPolicy()
                             .UseCacheControl()
-                            .RemovePoweredByHeader()
                             .UseXssProtection()
                             .UseCrossOriginResourcePolicy()
                             .Build();

diff --git a/tests/Dfe.EarlyYearsQualification.UnitTests/Dfe.EarlyYearsQualification.UnitTests.csproj b/tests/Dfe.EarlyYearsQualification.UnitTests/Dfe.EarlyYearsQualification.UnitTests.csproj
@@ -13,8 +13,8 @@
         <PackageReference Include="FluentAssertions" Version="7.0.0" />
         <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
         <PackageReference Include="moq" Version="4.20.72"/>
-        <PackageReference Include="MSTest.TestAdapter" Version="3.6.3" />
-        <PackageReference Include="MSTest.TestFramework" Version="3.6.3" />
+        <PackageReference Include="MSTest.TestAdapter" Version="3.6.4" />
+        <PackageReference Include="MSTest.TestFramework" Version="3.6.4" />
         <PackageReference Include="coverlet.collector" Version="6.0.2"/>
     </ItemGroup>
 

diff --git a/tests/Dfe.EarlyYearsQualification.UnitTests/Setup/SecureHeaderConfigurationTests.cs b/tests/Dfe.EarlyYearsQualification.UnitTests/Setup/SecureHeaderConfigurationTests.cs
@@ -23,11 +23,16 @@ public void SecureHeaderConfiguration_ExplicitConfiguration()
         config.UseReferrerPolicy.Should().BeTrue();
         config.UseExpectCt.Should().BeFalse();
         config.UseCacheControl.Should().BeTrue();
-        config.RemoveXPoweredByHeader.Should().BeTrue();
         config.UseCrossOriginResourcePolicy.Should().BeTrue();
-        config.HstsConfiguration.IncludeSubDomains.Should().BeTrue();
-        config.HstsConfiguration.MaxAge.Should().Be(31536000);
-        config.XFrameOptionsConfiguration.OptionValue.Should().Be(XFrameOptions.Deny);
+        config.HstsConfiguration.Should().NotBeNull();
+        var hstsHeaderValue = config.HstsConfiguration.BuildHeaderValue();
+        hstsHeaderValue.Should().NotBeNull();
+        hstsHeaderValue.Should().Contain("max-age=31536000");
+        hstsHeaderValue.Should().Contain("includeSubDomains");
+        config.XFrameOptionsConfiguration.Should().NotBeNull();
+        var xFrameOptionHeaderValue = config.XFrameOptionsConfiguration.BuildHeaderValue();
+        xFrameOptionHeaderValue.Should().NotBeNull();
+        xFrameOptionHeaderValue.Should().Contain("DENY");
         config.XFrameOptionsConfiguration.AllowFromDomain.Should().BeNull();
         config.ContentSecurityPolicyConfiguration.BaseUri.Should().BeEmpty();
         config.ContentSecurityPolicyConfiguration.DefaultSrc.Should().BeEmpty();