Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

No guidance for CSP #34351

Open
akurone opened this issue Dec 12, 2024 · 8 comments
Open

No guidance for CSP #34351

akurone opened this issue Dec 12, 2024 · 8 comments
Assignees
@Rick-Anderson
Labels
aspnet-core/svc doc-enhancement fundamentals/subsvc Source - Docs.ms Docs Customer feedback via GitHub Issue

Comments

@akurone
Copy link

akurone commented Dec 12, 2024 •
edited by guardrex
Loading

[Moving from consideration for Blazor's Static Files (or CSP) article because this applies to any ASP.NET Core app that relies on Map Static Asset routing conventions. See my issue comment below 👇 for more information.]

Description

Hello,

After updating my (WASM) Blazor project to .net9 and switching to map static assets, I have encountered problems with content security policy: due to security requirements of the project I have to send a rather strict policy that only enables safe sources to run on the page. But the I could not find a way to handle the <ImportMap /> part with that CSP: it renders as an inline script tag (which is not allowed by CSP header) but contents of the inline script changes when the related output changes (fine for me but) so it cannot be excluded from CSP with a hash. I could not find any info for CSP on this page (also tried security section in Blazor docs); am I missing something?

Page URL

https://learn.microsoft.com/en-us/aspnet/core/fundamentals/static-files?view=aspnetcore-9.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/fundamentals/static-files.md

Document ID

3fec6e08-fc99-7a5c-796f-3f2347cad891

Article author

@Rick-Anderson

Related Issues
@github-project-automation github-project-automation bot moved this to Triage in Blazor.Docs Dec 12, 2024
@guardrex
Copy link
Collaborator

Hello @akurone ... Open this for the product unit to take a look at ...

https://github.com/dotnet/aspnetcore/issues

Please add ...

cc: @guardrex https://github.com/dotnet/AspNetCore.Docs/issues/34351

... to the bottom of your opening comment so that I can follow along. I might re-open this for doc work depending on what they say.

@github-project-automation github-project-automation bot moved this from Triage to Done in Blazor.Docs Dec 12, 2024
@guardrex
Copy link
Collaborator

guardrex commented Dec 12, 2024 •
edited
Loading

BTW @akurone ... The CSP article link is below in case you didn't see it, but I feel like it isn't going to help with your question because we only cover adding a script-src with a stable hash (or script-src 'unsafe-inline'; to allow them all), so you'll probably need to talk to the product unit about what's going on with your app.

https://learn.microsoft.com/en-us/aspnet/core/blazor/security/content-security-policy?view=aspnetcore-9.0

One thing occurred to me that you might be able to control <head> content dynamically to load a dynamic hash of a dynamic script. Still tho, I'm not sure if that would work. I've never personally tried that approach. It's best if you chat with the engineers about what your app needs to do. I'll keep an 👁 on your product unit issue; and if we need to improve the CSP article, I'll re-open this issue to work on it.

@akurone
Copy link
Author

akurone commented Dec 13, 2024

thanks @guardrex both for quick and detailed reply; i will make a repro (meanwhile try the head trick you mentioned) first than open the issue there.

happy holidays!

@guardrex
Copy link
Collaborator

Sure thing. Yes, I think we would try to cover something about doing this. If you have success with controlling the CSP tag yourself via controlling <head> content, then I'll put up a remark about that in the CSP article, and I'll check with the product unit to make sure that they're happy with what I write. If that approach fails, we'll see what they say on a PU issue and cover it either way based on what they tell you.

Since I'm fairly certain that we do want to cover this subject, I'm going to re-open this issue and place it on hold for right now.

@guardrex guardrex reopened this Dec 13, 2024
@github-project-automation github-project-automation bot moved this from Done to Triage in Blazor.Docs Dec 13, 2024
@guardrex guardrex moved this from Triage to On Hold in Blazor.Docs Dec 13, 2024
@akurone akurone mentioned this issue Dec 14, 2024
Closed
1 task
@akurone
Copy link
Author

akurone commented Dec 14, 2024

hi @guardrex, i opened the issue. i fiddled around with the <head> but it was going to be very hacky so didn't chase it.

@guardrex
Copy link
Collaborator

guardrex commented Dec 16, 2024 •
edited
Loading

Moving from consideration for Blazor's Static Files (or CSP) article to the main doc set Static Files article because this applies to any ASP.NET Core app that relies on Map Static Asset routing conventions with an ImportMap.

Javier explains the three approaches to address this scenario on dotnet/aspnetcore#59486 ...

There are a few things you can do

  • Use a nonce on the script tag.
  • Grab the ImportMap from httpContext.GetEndpoint().Metadata.GetOrderedMetadata<ImportMap>() and compute the integrity from the string representation "sha256-{Convert.ToBase64String(Sha256.HashData(importMap.ToString())}"
  • Avoid using the importmap at all (just here for completeness, ideally the second option is the best)

See dotnet/aspnetcore#59486 for a longer description of the scenario that this applies to.

@guardrex guardrex assigned Rick-Anderson and unassigned guardrex Dec 16, 2024
@guardrex guardrex removed this from Blazor.Docs Dec 16, 2024
@dotnet dotnet deleted a comment from github-actions bot Dec 16, 2024
@akurone
Copy link
Author

akurone commented Dec 16, 2024

thanks @guardrex, let me know if i can provide any help.

@guardrex
Copy link
Collaborator

@Rick-Anderson will take this over. We've split the doc set among us by article and node (folder of articles). Rick maintains this article. He'll be on at some point, and I'm sure if you want to submit a PR to address this that he'd be happy to have it. You'd just need to work out with him where in the article (or in a different article) the guidance should be placed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Rick-Anderson Rick-Anderson

Labels
aspnet-core/svc doc-enhancement fundamentals/subsvc Source - Docs.ms Docs Customer feedback via GitHub Issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@akurone @guardrex @Rick-Anderson