CORS环境中违反内容安全政策

Question

I have an angular 2 client, a resource server and an authentication server. Everything was running smoothly till I came to screeching halt this afternoon

here is an image of the error I am getting

Let me add that I have seen several issues relating to this and have tried almost all the solutions prescribed to no avail

I also have the following class that is suppose to provide me cover from this policy violation

 public class SecurityHeadersAttribute : ActionFilterAttribute
{
    public override void OnResultExecuting(ResultExecutingContext context)
    {
        var result = context.Result;
        if (result is ViewResult)
        {
            if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Type-Options"))
            {
                context.HttpContext.Response.Headers.Add("X-Content-Type-Options", "nosniff");
            }
            if (!context.HttpContext.Response.Headers.ContainsKey("X-Frame-Options"))
            {
                context.HttpContext.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
            }

            var csp = "default-src 'self'";
            // once for standards compliant browsers
            if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
            {
                context.HttpContext.Response.Headers.Add("Content-Security-Policy", csp);
            }
            // and once again for IE
            if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Security-Policy"))
            {
                context.HttpContext.Response.Headers.Add("X-Content-Security-Policy", csp);
            }
        }
    }
}

It however appears like after upgrading "Microsoft.AspNetCore.Mvc.Core" from version 1.1.2 to 1.1.3 my cover has been blown. How can I get round this challenge?

Answer 1

Your CSP policy needs to allow content from https://ajax.aspnetcdn.com . So try changing this:

var csp = "default-src 'self'";

…to this:

var csp = "default-src 'self'; style-src https://ajax.aspnetcdn.com"; script-src https://ajax.aspnetcdn.com;

But based on the error message cited in the question, it seems the Content-Security-Policy header value is getting set already somewhere other than in that part of your application code.

So rather than using context.HttpContext.Response.Headers.Add , which just adds another header, try using context.HttpContext.Response.Headers.Set to override the existing value.

If you do that, you also want to remove if condition wrapped around the place you're setting it.

So try changing this:

if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
{
    context.HttpContext.Response.Headers.Add("Content-Security-Policy", csp);
}

…to just this:

context.HttpContext.Response.Headers.Set("Content-Security-Policy", csp);

…so that in the end together you have this:

var csp = "default-src 'self'; style-src https://ajax.aspnetcdn.com"; script-src https://ajax.aspnetcdn.com;
context.HttpContext.Response.Headers.Set("Content-Security-Policy", csp);

And if that doesn't work then you need to find the other place in the backend code where the Content-Security-Policy header value is getting set, and change it so the value includes style-src https://ajax.aspnetcdn.com"; script-src https://ajax.aspnetcdn.com .