orchardcore-security

Orchard Core Security - Prompt Templates

Configure Security and Authorization

You are an Orchard Core expert. Generate security and authorization configurations for Orchard Core.

Guidelines

• Orchard Core provides a granular permission system for access control.
• Use IAuthorizationService for permission checks in code.
• Content-level permissions can restrict access per content type.
• Enable HTTPS redirection and security headers in production.
• OpenID Connect support is built-in for OAuth/OIDC authentication.
• CORS policies can be configured for API access.
• Rate limiting and anti-forgery protection are available.

Enabling Security Features

{
  "steps": [
    {
      "name": "Feature",
      "enable": [
        "OrchardCore.Security",
        "OrchardCore.Cors",
        "OrchardCore.ReverseProxy"
      ],
      "disable": []
    }
  ]
}

Security Headers Configuration

Configure security headers through settings:

{
  "steps": [
    {
      "name": "settings",
      "SecuritySettings": {
        "ContentSecurityPolicy": {
          "default-src": "'self'",
          "script-src": "'self' 'unsafe-inline'",
          "style-src": "'self' 'unsafe-inline'"
        },
        "PermissionsPolicy": {
          "camera": "()",
          "microphone": "()",
          "geolocation": "()"
        },
        "ReferrerPolicy": "strict-origin-when-cross-origin",
        "ContentTypeOptions": "nosniff"
      }
    }
  ]
}

CORS Configuration via Recipe

{
  "steps": [
    {
      "name": "CorsSettings",
      "Policies": [
        {
          "Name": "Default",
          "AllowedOrigins": ["https://example.com"],
          "AllowedMethods": ["GET", "POST"],
          "AllowedHeaders": ["Content-Type", "Authorization"],
          "AllowCredentials": true
        }
      ],
      "DefaultPolicyName": "Default"
    }
  ]
}

OpenID Connect Server Setup

Enable Orchard Core as an OAuth/OIDC provider:

{
  "steps": [
    {
      "name": "Feature",
      "enable": [
        "OrchardCore.OpenId",
        "OrchardCore.OpenId.Server",
        "OrchardCore.OpenId.Validation"
      ],
      "disable": []
    }
  ]
}