Implementierungs-Architektur für IIS

<?xml version="1.0" encoding="UTF-8"?>
<!-- web.config — Alle Security-Header zentral -->
<!-- Generiert aus Wolf-Agents Web Security Guide, Kapitel 00-16 -->
<configuration>
  <system.web>
    <!-- X-AspNet-Version Header entfernen -->
    <httpRuntime enableVersionHeader="false" />
  </system.web>

  <system.webServer>
    <!-- Server-Header entfernen (IIS 10+) -->
    <security>
      <requestFiltering removeServerHeader="true" />
    </security>

    <httpProtocol>
      <customHeaders>
        <!-- Unsichere Standard-Header entfernen -->
        <remove name="X-Powered-By" />

        <!-- Kap 01: Content Security Policy -->
        <add name="Content-Security-Policy"
             value="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests" />

        <!-- Kap 02: HSTS -->
        <add name="Strict-Transport-Security"
             value="max-age=31536000; includeSubDomains; preload" />

        <!-- Kap 04: Permissions Policy -->
        <add name="Permissions-Policy"
             value="camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=()" />

        <!-- Kap 05: Clickjacking-Schutz -->
        <add name="X-Frame-Options" value="SAMEORIGIN" />

        <!-- Kap 06: Referrer Policy -->
        <add name="Referrer-Policy"
             value="strict-origin-when-cross-origin" />

        <!-- Kap 07: MIME-Sniffing-Schutz -->
        <add name="X-Content-Type-Options" value="nosniff" />

        <!-- Kap 08: Cross-Origin Isolation -->
        <add name="Cross-Origin-Resource-Policy" value="same-origin" />
        <add name="Cross-Origin-Opener-Policy" value="same-origin" />

        <!-- Kap 16: Erweiterte Header -->
        <add name="Origin-Agent-Cluster" value="?1" />
        <add name="X-DNS-Prefetch-Control" value="off" />
      </customHeaders>
    </httpProtocol>

    <!-- HTTP zu HTTPS Redirect (URL Rewrite Module nötig) -->
    <rewrite>
      <rules>
        <rule name="HTTPS Redirect" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="off" ignoreCase="true" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

# PowerShell — Alle Security Headers auf einmal setzen
# Für Windows Server Core oder automatisierte Deployments
$sitePath = 'MACHINE/WEBROOT/APPHOST/Default Web Site'
$filter = "system.webServer/httpProtocol/customHeaders"

# X-Powered-By entfernen
Remove-WebConfigurationProperty -pspath $sitePath -filter $filter -name "." -AtElement @{name='X-Powered-By'}

# Security Headers hinzufügen
$headers = @(
  @{name='Strict-Transport-Security';     value='max-age=31536000; includeSubDomains; preload'},
  @{name='X-Frame-Options';               value='SAMEORIGIN'},
  @{name='X-Content-Type-Options';        value='nosniff'},
  @{name='Referrer-Policy';               value='strict-origin-when-cross-origin'},
  @{name='Permissions-Policy';            value='camera=(), microphone=(), geolocation=(), payment=()'},
  @{name='Cross-Origin-Resource-Policy';  value='same-origin'},
  @{name='Cross-Origin-Opener-Policy';    value='same-origin'},
  @{name='Origin-Agent-Cluster';          value='?1'}
)

foreach ($h in $headers) {
  Add-WebConfigurationProperty -pspath $sitePath -filter $filter -name "." -value $h
}

Write-Host "Security Headers gesetzt. IIS-Neustart nicht nötig."