Merge pull request #57 from damienbod/dev

Improve CSP, using nonce
damienbod · Jan 14, 2024 · f649951 · f649951
2 parents b3d4b9f + 6d755c2
commit f649951
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 14 deletions.
diff --git a/BlazorBffOpenIdConnect/Client/BlazorBffOpenIDConnect.Client.csproj b/BlazorBffOpenIdConnect/Client/BlazorBffOpenIDConnect.Client.csproj
@@ -8,10 +8,10 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="8.0.0" />
-		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="8.0.0" PrivateAssets="all" />
+		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="8.0.1" />
+		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="8.0.1" PrivateAssets="all" />
 		<PackageReference Include="Microsoft.Extensions.Http" Version="8.0.0" />
-		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="8.0.0" />
+		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="8.0.1" />
 	</ItemGroup>
 
 	<ItemGroup>

diff --git a/BlazorBffOpenIdConnect/Server/BlazorBffOpenIDConnect.Server.csproj b/BlazorBffOpenIdConnect/Server/BlazorBffOpenIDConnect.Server.csproj
@@ -12,9 +12,10 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="8.0.0" />
-		<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.0.0" NoWarn="NU1605" />
+		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="8.0.1" />
+		<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.0.1" NoWarn="NU1605" />
 		<PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders" Version="0.21.0" />
+		<PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders.TagHelpers" Version="0.21.0" />
 	</ItemGroup>
 
 </Project>
diff --git a/BlazorBffOpenIdConnect/Server/Pages/_Host.cshtml b/BlazorBffOpenIdConnect/Server/Pages/_Host.cshtml
@@ -2,6 +2,7 @@
 @namespace BlazorBffOpenIDConnect.Pages
 @using BlazorBffOpenIDConnect.Client
 @addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
+@addTagHelper *, NetEscapades.AspNetCore.SecurityHeaders.TagHelpers
 @{
     Layout = null;
 }
@@ -40,8 +41,8 @@
         <a class="dismiss">🗙</a>
     </div>
 
-    <script src="_framework/blazor.webassembly.js" ></script>
-    <script src="antiForgeryToken.js" ></script>
+    <script asp-add-nonce src="_framework/blazor.webassembly.js"></script>
+    <script asp-add-nonce src="antiForgeryToken.js"></script>
     @Html.AntiForgeryToken()
 </body>
 </html>
diff --git a/BlazorBffOpenIdConnect/Server/SecurityHeadersDefinitions.cs b/BlazorBffOpenIdConnect/Server/SecurityHeadersDefinitions.cs
@@ -2,15 +2,17 @@
 
 public static class SecurityHeadersDefinitions
 {
-    public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev, string idpHost)
+    public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev, string? idpHost)
     {
+        ArgumentNullException.ThrowIfNull(idpHost);
+
         var policy = new HeaderPolicyCollection()
             .AddFrameOptionsDeny()
             .AddContentTypeOptionsNoSniff()
             .AddReferrerPolicyStrictOriginWhenCrossOrigin()
             .AddCrossOriginOpenerPolicy(builder => builder.SameOrigin())
             .AddCrossOriginResourcePolicy(builder => builder.SameOrigin())
-            .AddCrossOriginEmbedderPolicy(builder => builder.RequireCorp()) // remove for dev if using hot reload
+            .AddCrossOriginEmbedderPolicy(builder => builder.RequireCorp())
             .AddContentSecurityPolicy(builder =>
             {
                 builder.AddObjectSrc().None();
@@ -24,12 +26,9 @@ public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev, strin
 
                 // due to Blazor
                 builder.AddScriptSrc()
-                    .Self()
-                    .WithHash256("v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA=")
+                    // .Self() Add this if you want to use the visual studio debugging tools
+                    .WithNonce()
                     .UnsafeEval();
-
-                // disable script and style CSP protection if using Blazor hot reload
-                // if using hot reload, DO NOT deploy with an insecure CSP
             })
             .RemoveServerHeader()
             .AddPermissionsPolicy(builder =>

diff --git a/Changelog.md b/Changelog.md
@@ -2,6 +2,12 @@
 
 [Readme](https://github.com/damienbod/Blazor.BFF.OpenIDConnect.Template/blob/main/README.md) 
 
+
+**2024-01-14** 3.0.2
+- Improve CSP, using nonce
+- updated packages
+
+
 **2023-12-31** 3.0.1
 - Open redirect protection on login