Do not promote using the CSP directive "block-all-mixed-content"

[yugabe]

Based on the relevant MDN articles, block-all-mixed-content and upgrade-insecure-requests, the block-all-mixed-content is considered obsolete, and using both is never recommended.

---

CSP: block-all-mixed-content Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

Warning: This directive is marked as obsolete in the specification: all mixed content is now blocked if it can't be autoupgraded.

---

CSP: upgrade-insecure-requests Note: The upgrade-insecure-requests directive is evaluated before block-all-mixed-content and if it is set, the latter is effectively a no-op. It is recommended to set either directive, but not both, unless you want to force HTTPS on older browsers that do not force it after a redirect to HTTP.

I suggest removing the CSP directive block-all-mixed-content from the page and leave only upgrade-insecure-requests, as it will be as secure as the alternative, but won't produce errors on the page, and will rewrite URLs to HTTPS endpoints.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 88177a7d-c9ff-c245-5629-a462c9258abf
• Version Independent ID: 6e0b5c52-90a1-5ca6-bfad-df33a8beae6c
• Content: Enforce a Content Security Policy for ASP.NET Core Blazor
• Content Source: aspnetcore/blazor/security/content-security-policy.md
• Product: aspnet-core
• Technology: aspnetcore-security
• GitHub Login: @guardrex
• Microsoft Alias: riande

[guardrex]

Thanks, @yugabe. We'll discuss here first before moving to the PR phase.

@mkArtakMSFT ... We'll need to triage this for the PU to take a look before proceeding given that what we show has been provided and approved by engineering. IIRC, Tanay was the last engineer to assist with the CSP config on https://github.com/dotnet/AspNetCore.Docs/pull/23365. We'll also need to scope the version(s) for any updates.

Cross-refs:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests

[guardrex]

UPDATE (8/11): Very sorry for the delay! There's a delay due to the work for the upcoming .NET 7 release. We'll get to this ASAP, but I don't have an ETA at this time.