I have added the following to my Blazor Interactive Server app using NWebSec:
app.UseHsts(options => options.MaxAge(days: 30));
app.UseXContentTypeOptions();
app.UseXXssProtection(options => options.EnabledWithBlockMode());
app.UseXfo(options => options.SameOrigin());
app.UseReferrerPolicy(opts => opts.NoReferrerWhenDowngrade());
app.UseCsp(options => options
.DefaultSources(s => s.Self()
.CustomSources("data:", "https:"))
.StyleSources(s => s.Self()
.CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
"fonts.googleapis.com")
.UnsafeInline()
)
.ImageSources(s => s.Self()
.CustomSources("data:", "https:"))
.FontSources(s => s.Self()
.CustomSources("fonts.googleapis.com"))
.ScriptSources(s => s.Self()
.CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
"cse.google.com")
.UnsafeInline()
.UnsafeEval()
)
.WorkerSources(s => s.Self()
.CustomSources("louishowe-dev.azurewebsites.net", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net"))
);
// NWebSec does not handle this (no updates to that library in 4 years)
app.Use(async (context, next) =>
{
context.Response.Headers.Add("Permissions-Policy", "geolocation=*, camera=(), microphone=()");
await next.Invoke();
});
And I am getting the errors:
Refused to load the font '<URL>' because it violates the following Content Security Policy directive: "font-src 'self' fonts.googleapis.com".
Understand this error
Refused to create a worker from 'blob:https://louishowe-dev.azurewebsites.net/02bff816-5188-44d1-9395-484a2964920e' because it violates the following Content Security Policy directive: "worker-src 'self' louishowe-dev.azurewebsites.net *.microsoft.com *.windows.net *.azurewebsites.net".
Uncaught SecurityError: Failed to construct 'Worker': Access to the script at 'blob:https://louishowe-dev.azurewebsites.net/02bff816-5188-44d1-9395-484a2964920e' is denied by the document's Content Security Policy.
I believe both of those urls are explicitly set as allowed. I event set louishowe-dev.azurewebsites.net along with *.azurewebsites.net. And yet it won’t create the worker. What am I doing wrong?
And for the font, not sure what I need to enable to allow <URL>.
1
I got it all working (h/t to JalpalPanchal who explained it all):
app.UseHsts(options => options.MaxAge(days: 30));
app.UseXContentTypeOptions();
app.UseXXssProtection(options => options.EnabledWithBlockMode());
app.UseXfo(options => options.SameOrigin());
app.UseReferrerPolicy(opts => opts.NoReferrerWhenDowngrade());
app.UseCsp(options => options
.DefaultSources(s => s.Self()
.CustomSources("data:", "https:"))
.StyleSources(s => s.Self()
.CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
"fonts.googleapis.com")
.UnsafeInline()
)
.ImageSources(s => s.Self()
.CustomSources("blob:", "data:", "https:"))
.FontSources(s => s.Self()
.CustomSources("fonts.googleapis.com", "fonts.gstatic.com", "*.microsoft.com",
"*.windows.net", "*.azurewebsites.net"))
.ScriptSources(s => s.Self()
.CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
"cse.google.com")
.UnsafeInline()
.UnsafeEval()
)
.WorkerSources(s => s.Self()
.CustomSources("blob:", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net"))
);
// NWebSec does not handle this
app.Use(async (context, next) =>
{
context.Response.Headers.Add("Permissions-Policy", "geolocation=*, camera=(), microphone=()");
await next.Invoke();
});
For the font error you could add Google and any other trusted domains in allowed list:
FontSources`:`.FontSources(s => s.Self()
.CustomSources("fonts.googleapis.com", "fonts.gstatic.com", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net")
)
and For the worker error, dynamically created workers using blob: URLs need to be explicitly allowed:
.WorkerSources(s => s.Self()
.CustomSources("blob:", "louishowe-dev.azurewebsites.net", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net")
)