Stott Security 2.6

[GeekInTheNorth]

Version 2.6

This update has been published to api.nuget.optimizely.com and nuget.org.

Thank you to @Sabah-Tahir and @adayinthelifeofapro for reaching out and providing information that helps me improve this package for you all.

Features

• Add the ability to Import/Export settings #196
  • Added a new Tools tab
  • Added the ability to export all settings as a JSON file from the Tools tab.
  • Added the ability to validate and import all settings as a JSON file from the Tools tab.
    • This action will be fully audited.

Bugs

• POST Error from /stott.security.optimizely/api/cspreporting/reporttoviolation/ in Azure Application Insights #202
  • Cleansed violation data when it is submitted via the report-uri or report-to endpoints.
    • The violating source is limited to 255 characters. If the Host and Path exceeds this limit, we will now reduce the reported URL to just the Host. If this still exceeds the limit, we will discard the report to protect the database.
    • The violated directive must also match one of those supported by the application, if this is not the case, then the report will be discarded.
• Improve Performance by reducing DbContext instantiations and Db Reads. #204
  • Increased overall cache duration of all security headers from 1 hour to 12 hours.
  • Added caching to the CSP Settings Service to reduce the number of calls to database.
    • Updated the Allow List Service to use the CSP Settings Service instead of the repository so that it can now benefit from caching of the CSP Settings.
  • Added lazy loading of dependencies to the following common services to avoid creating a DbContext unless absolutely required:
    • CSP Violation Report Service
    • CSP Settings Service
    • CORS Policy Provider
    • Header Compilation Service
  • Observed Improvements over a limited test run:
    • Above 95% reduction in the creation of DbContexts.
    • Above 97% reduction in the number of requests to get settings from the database.
    • It is expected that these gains will be higher in a production environment.

---

This discussion was created from the release Stott Security 2.6.

Help me celebrate this release with a coffee on ko-fi: