Skip to content

Update Blazor CSP Guidance #23365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 8, 2021
Merged

Update Blazor CSP Guidance #23365

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5a80e8e
Update Blazor CSP Guidance
TanayParikh Sep 21, 2021
5afd357
Update aspnetcore/blazor/security/content-security-policy.md
TanayParikh Sep 21, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 9 additions & 12 deletions aspnetcore/blazor/security/content-security-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,12 @@ Minimally, specify the following directives and sources for Blazor apps. Add add
* Specify `self` to indicate that the app's origin, including the scheme and port number, is a valid source.
* In a Blazor WebAssembly app:
* Specify hashes to permit required scripts to load.
* Specify `unsafe-eval` to use `eval()` and methods for creating code from strings.
* Specify `unsafe-eval` to permit the Blazor WebAssembly mono runtime to function.
* In a Blazor Server app, specify hashes to permit required scripts to load.
* [style-src](https://developer.mozilla.org/docs/Web/HTTP/Headers/Content-Security-Policy/style-src): Indicates valid sources for stylesheets.
* Specify the `https://stackpath.bootstrapcdn.com/` host source for Bootstrap stylesheets.
* Specify `self` to indicate that the app's origin, including the scheme and port number, is a valid source.
* Specify `unsafe-inline` to allow the use of inline styles. The inline declaration is required for the UI in Blazor Server apps for reconnecting the client and server after the initial request. In a future release, inline styling might be removed so that `unsafe-inline` is no longer required.
* Specify `unsafe-inline` to allow the use of inline styles.
* [upgrade-insecure-requests](https://developer.mozilla.org/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests): Indicates that content URLs from insecure (HTTP) sources should be acquired securely over HTTPS.

The preceding directives are supported by all browsers except Microsoft Internet Explorer.
Expand Down Expand Up @@ -80,16 +80,16 @@ In the `<head>` content of the `wwwroot/index.html` host page, apply the directi
default-src 'self';
img-src data: https:;
object-src 'none';
script-src https://stackpath.bootstrapcdn.com/
'self'
script-src 'self'
'sha256-v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA='
'unsafe-eval';
style-src https://stackpath.bootstrapcdn.com/
'self'
'unsafe-inline';
style-src 'self';
upgrade-insecure-requests;">
```

> [!NOTE]
> The `sha256-v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA=` hash represents the [inline](https://github.com/dotnet/aspnetcore/blob/57501251222b199597b9ac16888f362a69eb13c1/src/Components/Web.JS/src/Platform/Mono/MonoPlatform.ts#L212) script that's used for Blazor WebAssembly. This may be removed in the future.

Add additional `script-src` and `style-src` hashes as required by the app. During development, use an online tool or browser developer tools to have the hashes calculated for you. For example, the following browser tools console error reports the hash for a required script not covered by the policy:

> Refused to execute inline script because it violates the following Content Security Policy directive: " ... ". Either the 'unsafe-inline' keyword, a hash ('sha256-v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA='), or a nonce ('nonce-...') is required to enable inline execution.
Expand All @@ -107,11 +107,8 @@ In the `<head>` content of the `Pages/_Layout.cshtml` host page, apply the direc
default-src 'self';
img-src data: https:;
object-src 'none';
script-src https://stackpath.bootstrapcdn.com/
'self';
style-src https://stackpath.bootstrapcdn.com/
'self'
'unsafe-inline';
script-src 'self';
style-src 'self';
upgrade-insecure-requests;">
```

Expand Down