No guidance for CSP #34351
Description
[Moving from consideration for Blazor's Static Files (or CSP) article because this applies to any ASP.NET Core app that relies on Map Static Asset routing conventions. See my issue comment below 👇 for more information.]
Description
Hello,
After updating my (WASM) Blazor project to .net9 and switching to map static assets, I have encountered problems with content security policy: due to security requirements of the project I have to send a rather strict policy that only enables safe sources to run on the page. But the I could not find a way to handle the <ImportMap /> part with that CSP: it renders as an inline script tag (which is not allowed by CSP header) but contents of the inline script changes when the related output changes (fine for me but) so it cannot be excluded from CSP with a hash. I could not find any info for CSP on this page (also tried security section in Blazor docs); am I missing something?
Page URL
https://learn.microsoft.com/en-us/aspnet/core/fundamentals/static-files?view=aspnetcore-9.0
Content source URL
https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/fundamentals/static-files.md
Document ID
3fec6e08-fc99-7a5c-796f-3f2347cad891
Article author
Metadata
Metadata
Assignees
Type
Projects
Status