abp
abp copied to clipboard
abpframework
Content-Security-Policy header not set
Is there an existing issue for this?
- [X] I have searched the existing issues
Description
I would like Content-Security-Policy headers to be set. I have implemented this following the documentation, but no such headers are set.
Configure<AbpSecurityHeadersOptions>(options =>
{
options.UseContentSecurityPolicyHeader = true; //false by default
options.ContentSecurityPolicyValue = "object-src 'none'; form-action 'self'; frame-ancestors 'none'"; //default value
});
It's a Blazor server app, but that should work there too, right? Does it depend on when I configure this (at which position in the ConfigureServices method)?
Reproduction Steps
No response
Expected behavior
The response header "Content-Security-Policy" is set to the values: object-src 'none'; form-action 'self'; frame-ancestors 'none'
Actual behavior
No response header "Content-Security-Policy" is set
Regression?
No response
Known Workarounds
If I add the header myself, it works:
Configure<AbpSecurityHeadersOptions>(options =>
{
options.Headers["Content-Security-Policy"] = "object-src 'none'; form-action 'self'; frame-ancestors 'none'";
});
Version
8.0.4
User Interface
Blazor Server
Database Provider
EF Core (Default)
Tiered or separate authentication server
None (Default)
Operation System
Windows (Default)
Other information
No response
Hi @ageiter ,
As far as I understand, you added app.UseAbpSecurityHeaders(); before app.UseRouting();. Can you add app.UseAbpSecurityHeaders(); after app.UseRouting(); and try again?
Why are you already closing the issue?
In your default template, this method is called BEFORE UseRouting:
But it seems to work when I push it down.
Please change the template accordingly and make a note in the documentation... https://docs.abp.io/en/abp/latest/UI/AspNetCore/Security-Headers
Thank you for updating the documentation.
Will you also change the template with which a new solution (Blazor Server) can be generated (via ABP Suite)?
Thank you for updating the documentation.
Will you also change the template with which a new solution (Blazor Server) can be generated (via ABP Suite)?
I've also updated the templates and they should be fixed in the new version.