aspnetcore-security-headers
aspnetcore-security-headers copied to clipboard
Add CspReport Object
It can often make sense to implement a report endpoint into the same .NET project that uses this library for setting the CSP-header. A CSP-report is a JSON-structure. It would be nice to have a pre-made object in this library we can serialize into out-of-the-box with easily accessable properties. Usage example:
[HttpPost]
public IActionResult ReportEndpoint(CspReport report)
{
Console.Log(report.DocumentUri.ToString());
Console.Log(report.ViolatedDirective);
Console.Log(report.BlockedUri.ToString());
return Ok();
}
Good idea :) The structure should be this one at the moment: https://w3c.github.io/webappsec-csp/#deprecated-serialize-violation. Based on the name and some comments in the spec, it seems they are actively trying to evolve this structure though. One request per violation does feel a bit inefficient.