[{"data":1,"prerenderedAt":1256},["ShallowReactive",2],{"i-feather:search":3,"i-feather:x":8,"i-feather:moon":10,"i-feather:sun":12,"i-lucide:house-heart":14,"i-fa-brands:youtube":16,"i-fa-brands:twitch":20,"i-fa-brands:github":22,"i-fa-brands:linkedin":25,"i-fa-brands:stack-overflow":28,"i-simple-icons:bluesky":31,"i-fa-brands:mastodon":33,"i-fa-regular:envelope":35,"i-fa-solid:rss":37,"post-\u002Fcontent-security-policy-for-asp-net-mvc\u002F":39,"i-fa-solid:share-alt":1240,"i-fa-brands:facebook":1242,"i-fa-brands:twitter":1244,"i-fa-brands:reddit":1246,"i-fa-brands:patreon":1248,"i-simple-icons:buymeacoffee":1250,"i-fa-brands:paypal":1252,"i-fa-regular:question-circle":1254},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"11\" cy=\"11\" r=\"8\"\u002F>\u003Cpath d=\"m21 21l-4.35-4.35\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M21 12.79A9 9 0 1 1 11.21 3A7 7 0 0 0 21 12.79\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"5\"\u002F>\u003Cpath d=\"M12 1v2m0 18v2M4.22 4.22l1.42 1.42m12.72 12.72l1.42 1.42M1 12h2m18 0h2M4.22 19.78l1.42-1.42M18.36 5.64l1.42-1.42\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8.62 13.8A2.25 2.25 0 1 1 12 10.836a2.25 2.25 0 1 1 3.38 2.966l-2.626 2.856a.998.998 0 0 1-1.507 0z\"\u002F>\u003Cpath d=\"M3 10a2 2 0 0 1 .709-1.528l7-6a2 2 0 0 1 2.582 0l7 6A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":17,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":19},576,512,"\u003Cpath fill=\"currentColor\" d=\"M549.655 124.083c-6.281-23.65-24.787-42.276-48.284-48.597C458.781 64 288 64 288 64S117.22 64 74.629 75.486c-23.497 6.322-42.003 24.947-48.284 48.597c-11.412 42.867-11.412 132.305-11.412 132.305s0 89.438 11.412 132.305c6.281 23.65 24.787 41.5 48.284 47.821C117.22 448 288 448 288 448s170.78 0 213.371-11.486c23.497-6.321 42.003-24.171 48.284-47.821c11.412-42.867 11.412-132.305 11.412-132.305s0-89.438-11.412-132.305m-317.51 213.508V175.185l142.739 81.205z\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":21},"\u003Cpath fill=\"currentColor\" d=\"M391.17 103.47h-38.63v109.7h38.63ZM285 103h-38.63v109.75H285ZM120.83 0L24.31 91.42v329.16h115.83V512l96.53-91.42h77.25L487.69 256V0Zm328.24 237.75l-77.22 73.12h-77.24l-67.6 64v-64h-86.87V36.58h308.93Z\"\u002F>",{"left":4,"top":4,"width":23,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":24},496,"\u003Cpath fill=\"currentColor\" d=\"M165.9 397.4c0 2-2.3 3.6-5.2 3.6c-3.3.3-5.6-1.3-5.6-3.6c0-2 2.3-3.6 5.2-3.6c3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9c2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9c.3 2 2.9 3.3 5.9 2.6c2.9-.7 4.9-2.6 4.6-4.6c-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2c12.8 2.3 17.3-5.6 17.3-12.1c0-6.2-.3-40.4-.3-61.4c0 0-70 15-84.7-29.8c0 0-11.4-29.1-27.8-36.6c0 0-22.9-15.7 1.6-15.4c0 0 24.9 2 38.6 25.8c21.9 38.6 58.6 27.5 72.9 20.9c2.3-16 8.8-27.1 16-33.7c-55.9-6.2-112.3-14.3-112.3-110.5c0-27.5 7.6-41.3 23.6-58.9c-2.6-6.5-11.1-33.3 2.6-67.9c20.9-6.5 69 27 69 27c20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27c13.7 34.7 5.2 61.4 2.6 67.9c16 17.7 25.8 31.5 25.8 58.9c0 96.5-58.9 104.2-114.8 110.5c9.2 7.9 17 22.9 17 46.4c0 33.7-.3 75.4-.3 83.6c0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252C496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2c1.6 1.6 3.9 2.3 5.2 1c1.3-1 1-3.3-.7-5.2c-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9c1.6 1 3.6.7 4.3-.7c.7-1.3-.3-2.9-2.3-3.9c-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2c2.3 2.3 5.2 2.6 6.5 1c1.3-1.3.7-4.3-1.3-6.2c-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2c-1.4-2.3-4-3.3-5.6-2\"\u002F>",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":27},448,"\u003Cpath fill=\"currentColor\" d=\"M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3M135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5c0 21.3-17.2 38.5-38.5 38.5m282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7c-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5c67.2 0 79.7 44.3 79.7 101.9z\"\u002F>",{"left":4,"top":4,"width":29,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":30},384,"\u003Cpath fill=\"currentColor\" d=\"M290.7 311L95 269.7L86.8 309l195.7 41zm51-87L188.2 95.7l-25.5 30.8l153.5 128.3zm-31.2 39.7L129.2 179l-16.7 36.5L293.7 300zM262 32l-32 24l119.3 160.3l32-24zm20.5 328h-200v39.7h200zm39.7 80H42.7V320h-40v160h359.5V320h-40z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":32},"\u003Cpath fill=\"currentColor\" d=\"M5.202 2.857C7.954 4.922 10.913 9.11 12 11.358c1.087-2.247 4.046-6.436 6.798-8.501C20.783 1.366 24 .213 24 3.883c0 .732-.42 6.156-.667 7.037c-.856 3.061-3.978 3.842-6.755 3.37c4.854.826 6.089 3.562 3.422 6.299c-5.065 5.196-7.28-1.304-7.847-2.97c-.104-.305-.152-.448-.153-.327c0-.121-.05.022-.153.327c-.568 1.666-2.782 8.166-7.847 2.97c-2.667-2.737-1.432-5.473 3.422-6.3c-2.777.473-5.899-.308-6.755-3.369C.42 10.04 0 4.615 0 3.883c0-3.67 3.217-2.517 5.202-1.026\"\u002F>",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":34},"\u003Cpath fill=\"currentColor\" d=\"M433 179.11c0-97.2-63.71-125.7-63.71-125.7c-62.52-28.7-228.56-28.4-290.48 0c0 0-63.72 28.5-63.72 125.7c0 115.7-6.6 259.4 105.63 289.1c40.51 10.7 75.32 13 103.33 11.4c50.81-2.8 79.32-18.1 79.32-18.1l-1.7-36.9s-36.31 11.4-77.12 10.1c-40.41-1.4-83-4.4-89.63-54a102.5 102.5 0 0 1-.9-13.9c85.63 20.9 158.65 9.1 178.75 6.7c56.12-6.7 105-41.3 111.23-72.9c9.8-49.8 9-121.5 9-121.5m-75.12 125.2h-46.63v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.33V197c0-58.5-64-56.6-64-6.9v114.2H90.19c0-122.1-5.2-147.9 18.41-175c25.9-28.9 79.82-30.8 103.83 6.1l11.6 19.5l11.6-19.5c24.11-37.1 78.12-34.8 103.83-6.1c23.71 27.3 18.4 53 18.4 175z\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":36},"\u003Cpath fill=\"currentColor\" d=\"M464 64H48C21.49 64 0 85.49 0 112v288c0 26.51 21.49 48 48 48h416c26.51 0 48-21.49 48-48V112c0-26.51-21.49-48-48-48m0 48v40.805c-22.422 18.259-58.168 46.651-134.587 106.49c-16.841 13.247-50.201 45.072-73.413 44.701c-23.208.375-56.579-31.459-73.413-44.701C106.18 199.465 70.425 171.067 48 152.805V112zM48 400V214.398c22.914 18.251 55.409 43.862 104.938 82.646c21.857 17.205 60.134 55.186 103.062 54.955c42.717.231 80.509-37.199 103.053-54.947c49.528-38.783 82.032-64.401 104.947-82.653V400z\"\u002F>",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":38},"\u003Cpath fill=\"currentColor\" d=\"M128.081 415.959c0 35.369-28.672 64.041-64.041 64.041S0 451.328 0 415.959s28.672-64.041 64.041-64.041s64.04 28.673 64.04 64.041m175.66 47.25c-8.354-154.6-132.185-278.587-286.95-286.95C7.656 175.765 0 183.105 0 192.253v48.069c0 8.415 6.49 15.472 14.887 16.018c111.832 7.284 201.473 96.702 208.772 208.772c.547 8.397 7.604 14.887 16.018 14.887h48.069c9.149.001 16.489-7.655 15.995-16.79m144.249.288C439.596 229.677 251.465 40.445 16.503 32.01C7.473 31.686 0 38.981 0 48.016v48.068c0 8.625 6.835 15.645 15.453 15.999c191.179 7.839 344.627 161.316 352.465 352.465c.353 8.618 7.373 15.453 15.999 15.453h48.068c9.034-.001 16.329-7.474 16.005-16.504\"\u002F>",{"id":40,"title":41,"author":42,"body":43,"comments":1069,"date":1196,"dateModified":1197,"description":1198,"extension":1199,"headings":1200,"heroImage":1227,"meta":1228,"path":81,"permalink":81,"published":1229,"stem":1230,"tags":1231,"timeToRead":131},"posts\u002Fposts\u002F2015\u002Fcontent-security-policy-for-asp-net-mvc\u002Findex.md","Content Security Policy (CSP) for ASP.NET MVC","Muhammad Rehan Saeed",{"type":44,"value":45,"toc":1066},"minimark",[46,113,116,139,152,155,176,188,201,211,214,221,229,234,237,244,247,255,261,272,281,293,300,303,306,309,319,330,339,342,345,350,361,364,367,370,380,383,394,410,427,430,441,444,454,465,474,484,491,493,498,501,506,509,517,534,537,540,543,554,557,563,571,582,596,608,623,634,643,650,653,665,675,686,695,698,701,707,719,722,725,736,742,745,748,760,771,774,785,805,820,831,842,850,861,864,908,919,928,939,950,959,970,973,976,987,990,1001,1010,1013,1024,1032,1044,1055,1062],[47,48,49,57,82,101,107],"ul",{},[50,51,52],"li",{},[53,54,56],"a",{"href":55},"\u002Fasp-net-mvc-boilerplate\u002F","ASP.NET Core Boilerplate",[50,58,59,63],{},[60,61,62],"p",{},"Security",[47,64,65,71,77],{},[50,66,67],{},[53,68,70],{"href":69},"\u002Fsecuring-the-aspnet-mvc-web-config\u002F","Securing the ASP.NET MVC Web.config (Updated)",[50,72,73],{},[53,74,76],{"href":75},"\u002Fnwebsec-asp-net-mvc-security-through-http-headers\u002F","NWebSec ASP.NET MVC Security Through HTTP Headers",[50,78,79],{},[53,80,41],{"href":81},"\u002Fcontent-security-policy-for-asp-net-mvc\u002F",[50,83,84,87],{},[60,85,86],{},"Search Engine Optimization (SEO)",[47,88,89,95],{},[50,90,91],{},[53,92,94],{"href":93},"\u002Fcanonical-urls-for-asp-net-mvc\u002F","Canonical URL's for ASP.NET MVC",[50,96,97],{},[53,98,100],{"href":99},"\u002Fdynamically-generating-robots-txt-using-asp-net-mvc","Dynamically Generating Robots.txt Using ASP.NET MVC",[50,102,103],{},[53,104,106],{"href":105},"\u002Finternet-favicon-madness\u002F","Internet Favicon Madness (Updated)",[50,108,109],{},[53,110,112],{"href":111},"\u002Fbuilding-rssatom-feeds-for-asp-net-mvc\u002F","Building RSS\u002FAtom Feeds for ASP.NET MVC",[60,114,115],{},"This series of blog posts goes through the additions made to the default ASP.NET MVC template to build the ASP.NET Core Boilerplate project template. You can create a new project using this template by installing the Visual Studio template extension or visit the GitHub site to view the source code.",[117,118,120,138],"h1",{"id":119},"what-is-csp",[53,121,124],{"href":122,"aria-hidden":123},"#what-is-csp","true",[125,126,132],"svg",{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},"http:\u002F\u002Fwww.w3.org\u002F2000\u002Fsvg","http:\u002F\u002Fwww.w3.org\u002F1999\u002Fxlink","0 0 16 16","1.1",22,[133,134],"path",{"fill":135,"fill-rule":136,"d":137},"currentColor","evenodd","M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z","What is CSP?",[60,140,141,142,151],{},"For a true in-depth look into CSP, I highly recommend reading ",[53,143,150],{"href":144,"rel":145,"target":149},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FSecurity\u002FCSP",[146,147,148],"nofollow","noopener","noreferrer","_blank","Mozilla","'s documentation on the subject. It really is the best resource on the web. I will assume that you've read the documentation and will be going through a few examples below.",[60,153,154],{},"Content Security Policy or CSP is a great new HTTP header that controls where a web browser is allowed to load content from and the type of content it is allowed to load. It uses a white-list of allowed content and blocks anything not in the allowed list. It gives us very fine grained control and allows us to run our site in a sandbox in the users browser.",[60,156,157,158,163,164,169,170,175],{},"CSP is all about adding an extra layer of security to your site using a ",[53,159,162],{"href":160,"rel":161,"target":149},"http:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FDefense_in_depth_%28computing%29",[146,147,148],"Defence in Depth"," strategy. It helps detect and mitigate ",[53,165,168],{"href":166,"rel":167,"target":149},"https:\u002F\u002Fwww.owasp.org\u002Findex.php\u002FCross-site_Scripting_%28XSS%29",[146,147,148],"Cross Site Scripting (XSS)"," and various data injection attacks, such as ",[53,171,174],{"href":172,"rel":173,"target":149},"https:\u002F\u002Fwww.owasp.org\u002Findex.php\u002FSQL_Injection",[146,147,148],"SQL Injection",".",[177,178,180,187],"h2",{"id":179},"real-world-example",[53,181,183],{"href":182,"aria-hidden":123},"#real-world-example",[125,184,185],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,186],{"fill":135,"fill-rule":136,"d":137},"Real World Example",[60,189,190,191,195,196,200],{},"So what does this look like in a web browser. Well, here is an example of a ",[192,193,194],"code",{},"Content-Security-Policy"," HTTP header shown in Chrome. I used the ",[53,197,56],{"href":198,"rel":199,"target":149},"https:\u002F\u002Fvisualstudiogallery.msdn.microsoft.com\u002F6cf50a48-fc1e-4eaf-9e82-0b2a6705ca7d",[146,147,148]," Visual Studio project template to create a ASP.NET MVC project that has CSP applied, right out of the box.",[60,202,203],{},[204,205],"img",{"alt":206,"src":207,"width":208,"height":209,"loading":210},"Content Security Policy HTTP Header","\u002Fcontent-images\u002Fposts\u002F2015\u002Fcontent-security-policy-for-asp-net-mvc\u002Fimages\u002FContent-Security-Policy-HTTP-Header.png",1018,651,"lazy",[60,212,213],{},"This is the HTTP header in the screenshot above. We'll discuss it in a lot more detail later in this post. Essentially it says, block everything, except scripts, images, fonts, Ajax requests and forms to or from my domain and also allow scripts from the Google and Microsoft CDN's.",[215,216],"pre",{"className":217,"language":218,"meta":219,"style":219,"html":220},"language-http shiki shiki-themes light-plus monokai","http","","\u003Cspan class=\"line\">\u003Cspan class=\"sjbfc\">Content-Security-Policy\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">:\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> default-src 'none';\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         script-src 'self' ajax.googleapis.com ajax.aspnetcdn.com;\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         style-src 'self' 'unsafe-inline';\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         img-src 'self';\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         font-src 'self';\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         connect-src 'self';\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         form-action 'self';\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         report-uri \u002FWebResource.axd?cspReport=true\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,222,223,224,228],{},"So for example, you may only want to load CSS, JavaScript and Images from your own trusted domain(s) and block everything else. You also might want to block any use of third party plug-ins (Flash or Silverlight) or frames. Using this type of policy, the only way an attacker could compromise your site using an XSS attack, would be to somehow get a malicious script from your own domain served up on your pages in ",[225,226,227],"strong",{},"separate script files"," as in-line styles and scripts are not blocked by CSP by default (You can turn this off but I will go on to tell you why this is a bad idea later on).",[215,230],{"className":231,"language":232,"meta":219,"style":219,"html":233},"language-xml shiki shiki-themes light-plus monokai","xml","\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> src\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"http:\u002F\u002Fevil.com\u002FScript.js\"\u003C\u002Fspan>\u003Cspan class=\"sNflI\">><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,235,236],{},"With the above CSP HTTP header in place if an attacker did manage to inject the script above, browsers would throw CSP violation errors and the evil script would not be executed or even downloaded. You can see what that looks like in Chrome below.",[60,238,239],{},[204,240],{"alt":241,"src":242,"width":208,"height":243,"loading":210},"Content Security Policy Violation","\u002Fcontent-images\u002Fposts\u002F2015\u002Fcontent-security-policy-for-asp-net-mvc\u002Fimages\u002FContent-Security-Policy-Violation.png",431,[60,245,246],{},"Even better, the browser never even downloads the evil script in the first place. You can compare the two screen-shots of Fiddler below. The left side shows that the evil Script.js file was never even requested but a Content Security Policy violation was logged to the URL highlighted (I'll talk more about this later). The right side shows the site with no CSP policy in effect. The browser tries to download the evil Script.js file and as this is just demo and I haven't gone to the trouble of setting up an evil website, it can't be found and returns a 404 Not Found.",[60,248,249],{},[204,250],{"alt":251,"src":252,"width":253,"height":254,"loading":210},"Fiddler Content Security Policy Violation","\u002Fcontent-images\u002Fposts\u002F2015\u002Fcontent-security-policy-for-asp-net-mvc\u002Fimages\u002FFiddler-Content-Security-Policy-Violation.png",578,505,[60,256,257],{},[204,258],{"alt":259,"src":260,"width":253,"height":254,"loading":210},"Fiddler No Content Security Policy Applied","\u002Fcontent-images\u002Fposts\u002F2015\u002Fcontent-security-policy-for-asp-net-mvc\u002Fimages\u002FFiddler-No-Content-Security-Policy-Applied.png",[177,262,264,271],{"id":263},"content-security-policy-directives",[53,265,267],{"href":266,"aria-hidden":123},"#content-security-policy-directives",[125,268,269],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,270],{"fill":135,"fill-rule":136,"d":137},"Content Security Policy Directives",[60,273,274,275,280],{},"There are a number of 'directives' that are used in the policy above. Mozilla has the full list of directives and how each is used ",[53,276,279],{"href":277,"rel":278,"target":149},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FSecurity\u002FCSP\u002FCSP_policy_directives",[146,147,148],"here",". Each directive controls access to a particular function in a web browser. I will not cover each one in details as they all work in the same way but I will cover the most important and unique directives below.",[282,283,285,292],"h3",{"id":284},"the-default-src-directive",[53,286,288],{"href":287,"aria-hidden":123},"#the-default-src-directive",[125,289,290],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,291],{"fill":135,"fill-rule":136,"d":137},"The default-src Directive",[60,294,295,296,299],{},"The ",[192,297,298],{},"default-src"," directive lets us apply some default restrictions. For example if I specified the following CSP policy, it would allow all types of content from my sites domain, as well as TrustedSite.com.",[215,301],{"className":217,"language":218,"meta":219,"style":219,"html":302},"\u003Cspan class=\"line\">\u003Cspan class=\"sjbfc\">Content-Security-Policy\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">:\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> default-src 'self' TrustedSite.com\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,304,305],{},"Now the above policy is pretty loose, it tells a browser it can load frames, Ajax requests, Web Sockets, fonts, images, audio, video, plug-ins, scripts and styles from both of those domains. It may well be that you don't use most of the things on that list. A much better policy would be to block everything by default and then only allow certain resources that you actually use as shown below.",[215,307],{"className":217,"language":218,"meta":219,"style":219,"html":308},"\u003Cspan class=\"line\">\u003Cspan class=\"sjbfc\">Content-Security-Policy\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">:\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> default-src 'none';\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         script-src TrustedSite.com; \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         style-src 'self'; \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         img-src 'self'; \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         font-src 'self'; \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         connect-src 'self'; \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         form-action 'self'\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,310,311,312,314,315,318],{},"You can see that ",[192,313,298],{}," has been set to ",[192,316,317],{},"none"," which blocks everything by default. Then we add other directives that allow, scripts from TrustedSite.com and styles, images, fonts, Ajax request and form submissions to my sites domain. This is a lot more secure and restrictive but it does require you to think more carefully about your policy.",[282,320,322,329],{"id":321},"the-report-uri-directive",[53,323,325],{"href":324,"aria-hidden":123},"#the-report-uri-directive",[125,326,327],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,328],{"fill":135,"fill-rule":136,"d":137},"The report-uri Directive",[60,331,295,332,335,336,175],{},[192,333,334],{},"report-uri"," directive is another special instruction. It gives the web browser a URL where it can post details of any violations to a CSP policy in JSON format. This is vitally important and allows us to find out about anyone trying to hack our site but probably much more likely, it allows us to find out about any resources that we have accidentally blocked because our policy was too restrictive and we did not do enough testing. In the example below, we are telling the browser to post CSP violation errors in JSON format to ",[192,337,338],{},"WebResource.axd?cspReport=true",[215,340],{"className":217,"language":218,"meta":219,"style":219,"html":341},"\u003Cspan class=\"line\">\u003Cspan class=\"sjbfc\">Content-Security-Policy\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">:\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> default-src 'self'; report-uri \u002FWebResource.axd?cspReport=true\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,343,344],{},"If we take the evil script above and try to add it to our page with the above CSP policy, we get a CSP violation error and you can see the JSON sent to us by the Chrome browser below. Please do note that different browsers do sent errors which are slightly different. Some browsers and indeed versions of browsers give more information than others.",[215,346],{"className":347,"language":348,"meta":219,"style":219,"html":349},"language-json shiki shiki-themes light-plus monokai","json","\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">{\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">    \"csp-report\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">        \"document-uri\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: \u003C\u002Fspan>\u003Cspan class=\"syaXe\">\"http:\u002F\u002Flocalhost:8080\u002F\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">        \"referrer\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: \u003C\u002Fspan>\u003Cspan class=\"syaXe\">\"\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">        \"violated-directive\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: \u003C\u002Fspan>\u003Cspan class=\"syaXe\">\"default-src 'self'\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">        \"effective-directive\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: \u003C\u002Fspan>\u003Cspan class=\"syaXe\">\"script-src\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">        \"original-policy\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: \u003C\u002Fspan>\u003Cspan class=\"syaXe\">\"default-src 'self';report-uri \u002FWebResource.axd?cspReport=true\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">        \"blocked-uri\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: \u003C\u002Fspan>\u003Cspan class=\"syaXe\">\"http:\u002F\u002Fevil.com\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"svrZB\">        \"status-code\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">: \u003C\u002Fspan>\u003Cspan class=\"s0PsH\">200\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    }\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">}\n\u003C\u002Fspan>\u003C\u002Fspan>",[282,351,353,360],{"id":352},"the-style-src-directive",[53,354,356],{"href":355,"aria-hidden":123},"#the-style-src-directive",[125,357,358],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,359],{"fill":135,"fill-rule":136,"d":137},"The style-src Directive",[60,362,363],{},"As I've mentioned before in-line styles are not allowed when using CSP because there is a risk that an attacker could inject in-line styles into a compromised page. All styles must be referenced from external CSS files as shown below.",[215,365],{"className":231,"language":232,"meta":219,"style":219,"html":366},"\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">link\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> href\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"\u002FSite.css\"\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> rel\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"stylesheet\"\u003C\u002Fspan>\u003Cspan class=\"sNflI\">\u002F>\n\u003C\u002Fspan>\u003C\u002Fspan>",[215,368],{"className":231,"language":232,"meta":219,"style":219,"html":369},"\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">style\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    p {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">        font-size:12pt;\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    }\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">style\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,371,372,373,376,377,175],{},"There is an extension to this directive which allows inline styles but you should avoid it as it is unsafe. Indeed the setting you have to pass to the ",[192,374,375],{},"style-src"," directive is called ",[192,378,379],{},"unsafe-inline",[215,381],{"className":217,"language":218,"meta":219,"style":219,"html":382},"\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">style-src 'self' 'unsafe-inline'\n\u003C\u002Fspan>\u003C\u002Fspan>",[282,384,386,393],{"id":385},"the-script-src-directive",[53,387,389],{"href":388,"aria-hidden":123},"#the-script-src-directive",[125,390,391],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,392],{"fill":135,"fill-rule":136,"d":137},"The script-src Directive",[60,395,396,397,399,400,403,404,409],{},"Just like the ",[192,398,375],{}," directive, ",[192,401,402],{},"script-src"," directive causes inline scripts to be blocked by default due to the risk of XSS attacks. Apart from inline scripts the JavaScript ",[53,405,408],{"href":406,"rel":407,"target":149},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FJavaScript\u002FReference\u002FGlobal_Objects\u002Feval",[146,147,148],"eval()"," function is also blocked by default.",[60,411,412,413,415,416,418,419,422,423,426],{},"Also just like the ",[192,414,402],{}," directive, there is a way to enable inline scripts too which is also called ",[192,417,379],{},". There is also another extension called ",[192,420,421],{},"unsafe-eval",", which allows access to the ",[192,424,425],{},"eval"," function. Once again these should be avoided and I have covered them here only because you should be wary of those who tell you to use them.",[215,428],{"className":217,"language":218,"meta":219,"style":219,"html":429},"\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">script-src 'self' 'unsafe-inline' 'unsafe-eval'\n\u003C\u002Fspan>\u003C\u002Fspan>",[177,431,433,440],{"id":432},"the-content-security-policy-report-only-http-header",[53,434,436],{"href":435,"aria-hidden":123},"#the-content-security-policy-report-only-http-header",[125,437,438],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,439],{"fill":135,"fill-rule":136,"d":137},"The Content-Security-Policy-Report-Only HTTP Header",[60,442,443],{},"CSP can be a pretty dangerous HTTP header if you have misconfigured it. Imagine a user visiting a site and wanting to view a YouTube video on your site but your CSP policy has blocked the video and all they see is a blank space where the video should be and no indication that something is wrong, unless they are clever enough to use the browser developer tools. That's a pretty poor user experience.",[60,445,446,447,450,451,453],{},"To combat this problem the W3C created the ",[192,448,449],{},"Content-Security-Policy-Report-Only"," HTTP header. This works just the same as ",[192,452,194],{}," but it only reports violations of your policy and does not cause the browser to actually block anything.",[117,455,457,464],{"id":456},"csp-for-aspnet-mvc",[53,458,460],{"href":459,"aria-hidden":123},"#csp-for-aspnet-mvc",[125,461,462],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,463],{"fill":135,"fill-rule":136,"d":137},"CSP for ASP.NET MVC",[60,466,467,468,473],{},"So you're sold on CSP and want to know how you can implement this great new HTTP header on your ASP.NET MVC website. Well, to get started all you need to do is install the ",[53,469,472],{"href":470,"rel":471,"target":149},"https:\u002F\u002Fwww.nuget.org\u002Fpackages\u002FNWebsec.Mvc\u002F",[146,147,148],"NWebsec.Mvc"," NuGet package.",[60,475,476,481,482,175],{},[53,477,480],{"href":478,"rel":479,"target":149},"https:\u002F\u002Fgithub.com\u002FNWebsec\u002FNWebsec",[146,147,148],"NWebsec"," is a great collection of MVC filters which can be applied globally to all requests or to individual controllers or actions. NWebSec contains a series of MVC filters to support CSP but includes several other filters which I've already blogged about ",[53,483,279],{"href":75},[60,485,486,487,490],{},"Here is the CSP policy I have applied to the ",[53,488,56],{"href":198,"rel":489,"target":149},[146,147,148]," site and the code which is used to create it. This policy is applied to all responses from the site.",[215,492],{"className":217,"language":218,"meta":219,"style":219,"html":220},[215,494],{"className":495,"language":496,"meta":219,"style":219,"html":497},"language-cs shiki shiki-themes light-plus monokai","cs","\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F Content-Security-Policy - Add the Content-Security-Policy HTTP header to enable Content-Security-Policy.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">GlobalFilters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">Filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">());\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F OR\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F Content-Security-Policy-Report-Only - Add the Content-Security-Policy-Report-Only HTTP header to enable logging of \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F      violations without blocking them. This is good for testing CSP without enabling it.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F      To make use of this attribute, rename all the attributes below to their ReportOnlyAttribute versions e.g. CspDefaultSrcAttribute \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F      becomes CspDefaultSrcReportOnlyAttribute.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F GlobalFilters.Filters.Add(new CspReportOnlyAttribute());\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F default-src - Sets a default source list for a number of directives. If the other directives below are not used \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F               then this is the default setting.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspDefaultSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Disallow everything from the same domain by default.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        None\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow everything from the same domain by default.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Self = true\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F connect-src - This directive restricts which URIs the protected resource can load using script interfaces \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F               (Ajax Calls and Web Sockets).\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspConnectSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow AJAX and Web Sockets to example.com.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F CustomSources = \"example.com\",\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow all AJAX and Web Sockets calls from the same domain.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        Self\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F font-src - This directive restricts from where the protected resource can load fonts.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspFontSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow fonts from example.com.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F CustomSources = \"example.com\",\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow all fonts from the same domain.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        Self\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F form-action - This directive restricts which URLs can be used as the action of HTML form elements.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspFormActionAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow forms to post back to example.com.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F CustomSources = \"example.com\",\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow forms to post back to the same domain.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        Self\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F img-src - This directive restricts from where the protected resource can load images.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspImgSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow images from example.com.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F CustomSources = \"example.com\",\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow images from the same domain.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        Self\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F script-src - This directive restricts which scripts the protected resource can execute. \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F              The directive also controls other resources, such as XSLT style sheets, which can cause the user agent to execute script.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspScriptSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow scripts from the CDN's.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        CustomSources\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sJvqV\"> string\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Format\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"swiDo\">\"ajax.googleapis.com ajax.aspnetcdn.com\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">),\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow scripts from the same domain.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        Self\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow the use of the eval() method to create code from strings. This is unsafe and can open your site up to XSS vulnerabilities.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F UnsafeEval = true,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow inline JavaScript, this is unsafe and can open your site up to XSS vulnerabilities.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F UnsafeInline = true\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F style-src - This directive restricts which styles the user applies to the protected resource.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspStyleSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow CSS from example.com\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F CustomSources = \"example.com\",\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow CSS from the same domain.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        Self\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">,\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Allow inline CSS, this is unsafe and can open your site up to XSS vulnerabilities.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F Note: This is currently enable because Modernizr does not support CSP and includes inline styles\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F in its JavaScript files. This is a security hold. If you don't want to use Modernizr, \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F be sure to disable unsafe inline styles. For more information see:\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F http:\u002F\u002Fstackoverflow.com\u002Fquestions\u002F26532234\u002Fmodernizr-causes-content-security-policy-csp-violation-errors\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F https:\u002F\u002Fgithub.com\u002FModernizr\u002FModernizr\u002Fpull\u002F1263\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">        UnsafeInline\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    });\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,499,500],{},"Notice how there is one MVC filter for each CSP directive. This is actually a very elegant solution. Consider the fact that you may want the actions in a particular controller to be able to display YouTube videos, note that YouTube makes use of iFrames to embed videos and it's embed mark-up is shown below.",[215,502],{"className":503,"language":504,"meta":219,"style":219,"html":505},"language-html shiki shiki-themes light-plus monokai","html","\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">iframe\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> width\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"560\"\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> height\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"315\"\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> src\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"https:\u002F\u002Fwww.youtube-nocookie.com\u002Fembed\u002FPGM_uBy99GA\"\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> frameborder\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"0\"\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> allow\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"accelerometer; encrypted-media; gyroscope; picture-in-picture\"\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> allowfullscreen\u003C\u002Fspan>\u003Cspan class=\"sNflI\">><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">iframe\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,507,508],{},"With the above CSP policy, the Chrome browser throws the following error.",[60,510,511],{},[204,512],{"alt":513,"src":514,"width":515,"height":516,"loading":210},"Content Security Policy Violation by YouTube iFrame","\u002Fcontent-images\u002Fposts\u002F2015\u002Fcontent-security-policy-for-asp-net-mvc\u002Fimages\u002FContent-Security-Policy-Violation-by-YouTube-iFrame.png",1008,382,[60,518,519,520,523,524,527,528,530,531,533],{},"We need to add the ",[192,521,522],{},"frame-src"," and ",[192,525,526],{},"child-src"," directive which can be added to the specific controller. Note that the ",[192,529,526],{}," directive is a CSP 2.0 directive and ",[192,532,522],{}," is deprecated in CSP 2.0 but we still need to add it for older browsers.",[215,535],{"className":495,"language":496,"meta":219,"style":219,"html":536},"\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">[\u003C\u002Fspan>\u003Cspan class=\"sw29p\">CspChildSrc\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">CustomSources\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> \"*.youtube.com\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">)]\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">[\u003C\u002Fspan>\u003Cspan class=\"sw29p\">CspFrameSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">CustomSources\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> \"*.youtube.com\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">)]\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">public\u003C\u002Fspan>\u003Cspan class=\"s4J9F\"> class\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> HomeController\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> : \u003C\u002Fspan>\u003Cspan class=\"sw29p\">Controller\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">{\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">    \u002F\u002F Action methods ommitted.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">}\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,538,539],{},"But what if we only want to allow a YouTube video to display for a single action rather, than all of the actions in a controller. Well its as simple as moving the attributes to the action, rather than the controller.",[215,541],{"className":495,"language":496,"meta":219,"style":219,"html":542},"\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">public\u003C\u002Fspan>\u003Cspan class=\"s4J9F\"> class\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> HomeController\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> : \u003C\u002Fspan>\u003Cspan class=\"sw29p\">Controller\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">{\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    [\u003C\u002Fspan>\u003Cspan class=\"sw29p\">CspChildSrc\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">CustomSources\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> \"*.youtube.com\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">)]\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    [\u003C\u002Fspan>\u003Cspan class=\"sw29p\">CspFrameSrcAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">CustomSources\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> \"*.youtube.com\"\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">)]\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">    public\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> ActionResult\u003C\u002Fspan>\u003Cspan class=\"sWm5y\"> Index\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">()\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">        \u002F\u002F This view displays a YouTube Video.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"smL5M\">        return\u003C\u002Fspan>\u003Cspan class=\"sK46n\"> this\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">View\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">();\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">    }\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">}\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,544,545,546,549,550,553],{},"Setting up the reporting of CSP violations is a bit more complicated. You need to add the ",[192,547,548],{},"CspReportUriAttribute"," MVC filter and add a special function in your ",[192,551,552],{},"Global.asax.cs"," file to actually handle a violation as shown below.",[215,555],{"className":495,"language":496,"meta":219,"style":219,"html":556},"\u003Cspan class=\"line\">\u003Cspan class=\"sFrd5\">filters\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sWm5y\">Add\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">new\u003C\u002Fspan>\u003Cspan class=\"sw29p\"> CspReportUriAttribute\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">() { \u003C\u002Fspan>\u003Cspan class=\"sFrd5\">EnableBuiltinHandler\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sMc8R\"> true\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> });\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">\u002F\u002F Added to Global.asax.cs\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sJvqV\">protected\u003C\u002Fspan>\u003Cspan class=\"sJvqV\"> void\u003C\u002Fspan>\u003Cspan class=\"sWm5y\"> NWebsecHttpHeaderSecurityModule_CspViolationReported\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">(\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">object\u003C\u002Fspan>\u003Cspan class=\"sFrd5\"> sender\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">, \u003C\u002Fspan>\u003Cspan class=\"sw29p\">CspViolationReportEventArgs\u003C\u002Fspan>\u003Cspan class=\"sFrd5\"> e\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">)\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">{\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sw29p\">    CspViolationReport\u003C\u002Fspan>\u003Cspan class=\"sFrd5\"> violationReport\u003C\u002Fspan>\u003Cspan class=\"snCLD\"> =\u003C\u002Fspan>\u003Cspan class=\"sFrd5\"> e\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">.\u003C\u002Fspan>\u003Cspan class=\"sFrd5\">ViolationReport\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">;\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"s1q82\">    \u002F\u002F Log the CSP violation here.\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">}\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,558,295,559,562],{},[192,560,561],{},"CspViolationReport"," is a representation of the JSON CSP violation that the browser sends you. It contains several properties, which can tell you about the blocked URL, the violated directive, the user agent and a lot more. This is your opportunity to log this data in your preferred logging framework.",[60,564,565,566,570],{},"One final note, all of this code is available to view on GitHub ",[53,567,279],{"href":568,"rel":569,"target":149},"https:\u002F\u002Fgithub.com\u002FDotnet-Boxed\u002FTemplates",[146,147,148]," and is part of the ASP.NET Core Boilerplate project template.",[117,572,574,581],{"id":573},"browser-support",[53,575,577],{"href":576,"aria-hidden":123},"#browser-support",[125,578,579],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,580],{"fill":135,"fill-rule":136,"d":137},"Browser Support",[60,583,584,585,589,590,595],{},"CSP is a proper standard, you can read the W3C documentation ",[53,586,279],{"href":587,"rel":588,"target":149},"http:\u002F\u002Fwww.w3.org\u002FTR\u002FCSP\u002F",[146,147,148],". According to the W3C at the time of writing, CSP is at ",[53,591,594],{"href":592,"rel":593,"target":149},"http:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FWorld_Wide_Web_Consortium#Candidate_Recommendation_.28CR.29",[146,147,148],"Candidate Recommentation",", which is \"a version of the standard that is more firm than the Working Draft\" and \"The standard document may change further, but at this point, significant features are mostly locked\".",[60,597,598,599,604,605,607],{},"If you take a look at ",[53,600,603],{"href":601,"rel":602,"target":149},"http:\u002F\u002Fcaniuse.com\u002F#search=CSP",[146,147,148],"CanIUse.com",", you can see that FireFox 23+, Chrome 25+, Safari 7+ and Opera 15+ already support the official ",[192,606,194],{}," HTTP header, while the next version of IE (Spartan or IE12, who knows what they'll name it?) will come with full support too.",[60,609,610,611,614,615,618,619,622],{},"A number of older browser versions supported CSP using the ",[192,612,613],{},"X-Content-Security-Policy"," or ",[192,616,617],{},"X-WebKit-CSP"," HTTP header (The ",[192,620,621],{},"X-"," is commonly used to add features to browsers which are not yet finalised) but these older implementations are buggy (Their use can mean content on your site gets blocked, even though you allowed it!) and should not be used.",[117,624,626,633],{"id":625},"content-security-policy-csp-20",[53,627,629],{"href":628,"aria-hidden":123},"#content-security-policy-csp-20",[125,630,631],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,632],{"fill":135,"fill-rule":136,"d":137},"Content Security Policy (CSP) 2.0",[60,635,636,637,642],{},"There is currently an 'Editors Draft' of ",[53,638,641],{"href":639,"rel":640,"target":149},"https:\u002F\u002Fw3c.github.io\u002Fwebappsec\u002Fspecs\u002Fcontent-security-policy\u002F",[146,147,148],"CSP 2.0",", written by the W3C standards body. It was published on 13 November 2014.",[60,644,645,646,649],{},"The intention of this version is to fill a few gaps and add a few new directives which allow control over web workers, embedded frames, application manifests, the HTML documents base URL, where forms can be posted and the types of plug-ins the browser can load. ",[53,647,480],{"href":478,"rel":648,"target":149},[146,147,148]," supports most of these new directives already (except notably the plug-in types) and you can start using them today.",[60,651,652],{},"As well as these changes, CSP 2.0 also tries to address the pain points in using CSP and perhaps the reason for its slow take-up so far i.e. the inability to safely use in-line CSS and JavaScript using the style and script tags in your HTML.",[60,654,655,656,661,662,664],{},"So why would you want to use in-line styles and scripts in the first place? Well, do you use ",[53,657,660],{"href":658,"rel":659,"target":149},"http:\u002F\u002Fmodernizr.com\u002F",[146,147,148],"Modernizr","? Yes, well Modernizr does not work with CSP (I discuss this below). It makes use of in-line styles to test for various web browser capabilities and so requires the ",[192,663,379],{}," directive to function. There are other libraries that also have a similar requirement. Other reasons for using in-line styles and scripts are to use CSP on an existing web application, where you don't want to spend time moving to separate script files.",[60,666,667,668,670,671,674],{},"CSP 1.0 had the ",[192,669,379],{}," directive which allowed the use of in-line style and script tags but it is pretty dangerous and makes CSP ",[225,672,673],{},"partially"," pointless. It gives attackers the ability to inject code into your site (Using another vulnerability in your site if there is one) and to pull off a Cross Site Scripting (XSS) attack. Using CSP 1.0 meant loading styles and scripts from separate CSS and JavaScript files. CSP 2.0 introduces two new ways to use in-line styles and scripts.",[177,676,678,685],{"id":677},"nonces",[53,679,681],{"href":680,"aria-hidden":123},"#nonces",[125,682,683],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,684],{"fill":135,"fill-rule":136,"d":137},"Nonces",[60,687,688,689,694],{},"Nonces work a little like the ",[53,690,693],{"href":691,"rel":692,"target":149},"http:\u002F\u002Fwww.asp.net\u002Fweb-api\u002Foverview\u002Fsecurity\u002Fpreventing-cross-site-request-forgery-%28csrf%29-attacks",[146,147,148],"Anti-Forgery Token"," in ASP.NET MVC. A cryptographically random string is generated and sent to the client in the CSP HTTP header, as well as in the HTML with the style or script tag like so:",[215,696],{"className":217,"language":218,"meta":219,"style":219,"html":697},"\u003Cspan class=\"line\">\u003Cspan class=\"sjbfc\">Content-Security-Policy\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">:\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> default-src 'self';\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> \n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">                         script-src 'self' https:\u002F\u002Fexample.com 'nonce-Nc3n83cnSAd3wc3Sasdfn939hc3'\n\u003C\u002Fspan>\u003C\u002Fspan>",[215,699],{"className":231,"language":232,"meta":219,"style":219,"html":700},"\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">alert(\"Blocked because the policy doesn't have 'unsafe-inline'.\")\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> nonce\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"EDNnf03nceIOfn39fn3e9h3sdfa\"\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">alert(\"Still blocked because nonce is wrong.\")\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"snDo4\"> nonce\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">=\u003C\u002Fspan>\u003Cspan class=\"squEy\">\"Nc3n83cnSAd3wc3Sasdfn939hc3\"\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">alert(\"Allowed because nonce is valid.\")\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,702,703,704,706],{},"There is a problem however, web browsers that only support CSP 1.0, will not understand the nonce directive and will block the in-line script above. To resolve this issue, we combine the nonce with the ",[192,705,379],{}," directive. CSP 1.0 web browsers will execute the in-line script as before (insecure but backwards compatible), but CSP 2.0 browsers will disregard 'unsafe-inline' when they see the nonce and only execute in-line scripts with the nonce set. This gives an upgrade path for existing sites and they can benefit from CSP 2.0 without requiring a massive rewrite to get rid of in-line styles and scripts.",[60,708,709,710,714,715,175],{},"Nonces can be easily implemented by using the HTML helper provided by ",[53,711,713],{"href":478,"rel":712,"target":149},[146,147,148],"NWebSec",". You can find out more about how this feature is implemented in NWebSec ",[53,716,279],{"href":717,"rel":718,"target":149},"https:\u002F\u002Fgithub.com\u002FNWebsec\u002FNWebsec\u002Fwiki\u002FConfiguring-Content-Security-Policy#script-and-style-nonces-through-htmlhelpers",[146,147,148],[215,720],{"className":231,"language":232,"meta":219,"style":219,"html":721},"\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> @Html.CspScriptNonce()\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\u003C\u002Fspan>\u003Cspan class=\"sjLUg\">document.write(\"Hello world\")\u003C\u002Fspan>\u003Cspan class=\"sNflI\"><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">style\u003C\u002Fspan>\u003Cspan class=\"sjLUg\"> @Html.CspStyleNonce()\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">   h1 {\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">          font-size: 10em;\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">        }\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">style\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,723,724],{},"The big disadvantage with this approach is that the nonce is different for each response sent to the client. This means that you cannot cache any page using nonces. If your page is specific to a user, then you probably don't want to cache that page anyway and it doesn't matter but otherwise using nonces is not possible.",[177,726,728,735],{"id":727},"hashes",[53,729,731],{"href":730,"aria-hidden":123},"#hashes",[125,732,733],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,734],{"fill":135,"fill-rule":136,"d":137},"Hashes",[60,737,738,739,741],{},"Using hashes solves the caching problem we have with nonces. The server computes the hash of a particular style or script tags contents, and includes the base64 encoding of that value in the ",[192,740,194],{}," header like so:",[215,743],{"className":217,"language":218,"meta":219,"style":219,"html":744},"\u003Cspan class=\"line\">\u003Cspan class=\"sjbfc\">Content-Security-Policy\u003C\u002Fspan>\u003Cspan class=\"sJvqV\">:\u003C\u002Fspan>\u003Cspan class=\"swiDo\"> script-src 'sha512-YWIzOWNiNzJjNDRlYzc4MTgwMDhmZDlkOWI0NTAyMjgyY2MyMWJlMWUyNjc1ODJlYWJhNjU5MGU4NmZmNGU3OAo='\n\u003C\u002Fspan>\u003C\u002Fspan>",[215,746],{"className":231,"language":232,"meta":219,"style":219,"html":747},"\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sjLUg\">\"alert('Hello, world.');\"\n\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"line\">\u003Cspan class=\"sNflI\"><\u002F\u003C\u002Fspan>\u003Cspan class=\"sjbfc\">script\u003C\u002Fspan>\u003Cspan class=\"sNflI\">>\n\u003C\u002Fspan>\u003C\u002Fspan>",[60,749,750,751,754,755,175],{},"As you can see, the script itself remains unchanged and only the HTTP header changes. We can now, happily cache the page with the in-line script in it. Unfortunately, at the time of writing ",[53,752,713],{"href":478,"rel":753,"target":149},[146,147,148]," does not support hashes at all. If you feel this feature is worthwhile as I do, then you can raise an issue on NWebSec's ",[53,756,759],{"href":757,"rel":758,"target":149},"https:\u002F\u002Fgithub.com\u002FNWebsec\u002FNWebsec\u002Fissues",[146,147,148],"issue list",[117,761,763,770],{"id":762},"other-csp-support",[53,764,766],{"href":765,"aria-hidden":123},"#other-csp-support",[125,767,768],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,769],{"fill":135,"fill-rule":136,"d":137},"Other CSP Support",[60,772,773],{},"So for the reasons you've learned above, using in-line styles and scripts is not the way to go. Apart from the fact that CSP will block them, you also cannot minify and obfuscate in-line scripts very easily using ASP.NET MVC (There are ways I have looked into but they aren't very good). So moving scripts to external CSS and JavaScript files will mean you can use CSP and you might get a small performance boost. So what's the problem? Well, CSP is not currently supported in a few major libraries.",[177,775,777,784],{"id":776},"modernizr-support-for-csp",[53,778,780],{"href":779,"aria-hidden":123},"#modernizr-support-for-csp",[125,781,782],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,783],{"fill":135,"fill-rule":136,"d":137},"Modernizr Support for CSP",[60,786,787,788,792,793,798,799,804],{},"As I've said above ",[53,789,660],{"href":790,"rel":791,"target":149},"http:\u002F\u002Fmodernizr.com",[146,147,148]," makes use of in-line styles to test for various web browser capabilities and so requires the insecure 'unsafe-inline' directive to function. There is a ",[53,794,797],{"href":795,"rel":796,"target":149},"https:\u002F\u002Fgithub.com\u002FModernizr\u002FModernizr\u002Fpull\u002F1263",[146,147,148],"fix"," for the problem but its very old and can no longer be merged into the current branch of the Modernizr code. I would fix it myself but I'm not enough of a JavaScript guru to do so. What I have done is raise ",[53,800,803],{"href":801,"rel":802,"target":149},"http:\u002F\u002Fstackoverflow.com\u002Fquestions\u002F26532234\u002Fmodernizr-causes-content-security-policy-csp-violation-errors",[146,147,148],"this"," Stack Overflow question which seeks to ask for a workaround or fix and to generally raise awareness.",[60,806,807,808,813,814,819],{},"So far, I've received no responses from GitHub or Stack Overflow but there is hope. ",[53,809,812],{"href":810,"rel":811,"target":149},"https:\u002F\u002Fangularjs.org",[146,147,148],"AngularJS"," (Another popular JavaScript library) has a ",[53,815,818],{"href":816,"rel":817,"target":149},"https:\u002F\u002Fdocs.angularjs.org\u002Fapi\u002Fng\u002Fdirective\u002FngCsp",[146,147,148],"CSP compatible mode"," which makes use of an external CSS file but is very easy to set up. There is no reason why Modernizr could not have something similar. Another alternative is if NWebSec supports hashes, we can add work out the hashes of any scripts that Modernizr is using and include these in our CSP HTTP header.",[177,821,823,830],{"id":822},"browser-link-support-for-csp",[53,824,826],{"href":825,"aria-hidden":123},"#browser-link-support-for-csp",[125,827,828],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,829],{"fill":135,"fill-rule":136,"d":137},"Browser Link Support for CSP",[60,832,833,838,839,841],{},[53,834,837],{"href":835,"rel":836,"target":149},"http:\u002F\u002Fwww.asp.net\u002Fvisual-studio\u002Foverview\u002F2013\u002Fusing-browser-link",[146,147,148],"Browser Link"," is a very cool Visual Studio feature that allows you to update an MVC view while debugging and hit a refresh button to refresh any browsers using that page. Unfortunately, this handy feature is not compatible with CSP because Visual Studio adds in-line scripts to the bottom of the page you are debugging. This of course, causes CSP violation errors. A simple workaround is to either introduce the ",[192,840,379],{}," directive while debugging or turn off browser link altogether.",[60,843,844,845,849],{},"I have raised ",[53,846,803],{"href":847,"rel":848,"target":149},"https:\u002F\u002Fvisualstudio.uservoice.com\u002Fforums\u002F121579-visual-studio\u002Fsuggestions\u002F7389853-browser-link-support-for-content-security-policy",[146,147,148]," suggestion on Visual Studio's User Voice page to get the problem fixed. I understand that this area has been changed significantly in ASP.NET Core, so it may not be needed by the time we all upgrade.",[117,851,853,860],{"id":852},"mainstream-csp-adoption",[53,854,856],{"href":855,"aria-hidden":123},"#mainstream-csp-adoption",[125,857,858],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,859],{"fill":135,"fill-rule":136,"d":137},"Mainstream CSP Adoption",[60,862,863],{},"So far, not many websites in the wild have implemented CSP. I think there are a few reasons:",[865,866,867,870,873,876,879,882,888,899,905],"ol",{},[50,868,869],{},"Lack of browser support (Until now).",[50,871,872],{},"Lack of awareness by developers (Until this blog post I hope).",[50,874,875],{},"Framework providers such as Microsoft and its ASP.NET MVC have not given developers a way to implement CSP (NWebSec has stepped in here to fill this gap).",[50,877,878],{},"Prevalence of the use of in-line styles and scripts and unwillingness to switch to separate files (This is up to you).",[50,880,881],{},"Lack of support for CSP from popular CSS\u002FJavaScript libraries due to the reason above (This is the biggest problem).",[50,883,884,885,887],{},"CSP gives us an extra layer of protection using a ",[53,886,162],{"href":160}," strategy. Some developers don't take web security seriously enough until they get hacked.",[50,889,890,891,614,893,895,896,898],{},"The older CSP HTTP headers (",[192,892,613],{},[192,894,617],{},") were buggy or had unexpected behaviour (The ",[192,897,194],{}," HTTP header no longer has this problem).",[50,900,901,902,904],{},"Developers are not making good use of the ability to report violations to their CSP policy using the ",[192,903,334],{}," directive. If you find a violation, you can quickly discover if someone is attacking your site, your CSP policy is not valid or you have a bug in your site.",[50,906,907],{},"Developers are scared of breaking their site because their CSP policy is too strict (This is often because CSP is being retrofitted to an existing spiders web of a site. If you start with CSP from the ground up, you will not have this problem).",[117,909,911,918],{"id":910},"csp-in-the-real-world",[53,912,914],{"href":913,"aria-hidden":123},"#csp-in-the-real-world",[125,915,916],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,917],{"fill":135,"fill-rule":136,"d":137},"CSP in the Real World",[60,920,921,922,927],{},"There is a really interesting white paper written in 2014 and titled '",[53,923,926],{"href":924,"rel":925,"target":149},"http:\u002F\u002Fmweissbacher.com\u002Fpublications\u002Fcsp_raid.pdf",[146,147,148],"Why is CSP Failing? Trends and Challenges in CSP Adoption","' which goes over these issues I listed above in a lot more depth.",[177,929,931,938],{"id":930},"who-is-using-csp",[53,932,934],{"href":933,"aria-hidden":123},"#who-is-using-csp",[125,935,936],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,937],{"fill":135,"fill-rule":136,"d":137},"Who is using CSP",[60,940,941,942,945,946,949],{},"According to the white paper, CSP is deployed in enforcement mode on only 1% of the Alexa Top 100 sites. I believe things are about to change. All major browsers now support the CSP HTTP header, ",[53,943,713],{"href":478,"rel":944,"target":149},[146,147,148]," makes it easy to add to an MVC project, this blog post tells you exactly how it works and the ",[53,947,56],{"href":198,"rel":948,"target":149},[146,147,148]," project template gives you a project template that enables CSP by default, right out of the box.",[60,951,952,953,958],{},"There are big names using CSP right now. Go ahead and check the HTTP response headers from sites like Facebook, CNN, BBC, Google, Huffington Post, YouTube, Twitter and GitHub. Things have moved on from when the white-paper was written and CSP adoption is starting to gain traction. Read ",[53,954,957],{"href":955,"rel":956,"target":149},"https:\u002F\u002Fblog.twitter.com\u002F2011\u002Fimproving-browser-security-csp",[146,147,148],"Twitter","'s case study, on adopting CSP.",[177,960,962,969],{"id":961},"browser-extensions-and-isps",[53,963,965],{"href":964,"aria-hidden":123},"#browser-extensions-and-isps",[125,966,967],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,968],{"fill":135,"fill-rule":136,"d":137},"Browser Extensions and ISP's",[60,971,972],{},"Another interesting finding from the white-paper was that browser extensions and even ISP's were injecting scripts into pages, that caused CSP violation reports. CSP may break some browser extensions that inject code into the page. You may consider this a good or bad thing. From a security point of view, what you need to ask is, do you really trust any browser extension to modify your code? I don't know about you but I don't want any extensions and especially any ISP's dirty fingers in my source code.",[60,974,975],{},"You can use SSL\u002FTLS which will stop most ISP's from fiddling with your code but some governments get around even this! So CSP gives us some extra protection from man in the middle attacks from browser extensions and ISP's.",[177,977,979,986],{"id":978},"csp-and-advertising",[53,980,982],{"href":981,"aria-hidden":123},"#csp-and-advertising",[125,983,984],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,985],{"fill":135,"fill-rule":136,"d":137},"CSP and Advertising",[60,988,989],{},"Advertising can be a problem for CSP. Some ad providers are better than others. Some providers use resources whose locations are constantly changing which can cause CSP violation errors if your policy is too strict. CNN has adopted a novel workaround for this problem. It embeds all of its adverts into frames which show pages with no CSP restrictions or at least very liberal ones.",[177,991,993,1000],{"id":992},"csp-policy-generation",[53,994,996],{"href":995,"aria-hidden":123},"#csp-policy-generation",[125,997,998],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,999],{"fill":135,"fill-rule":136,"d":137},"CSP Policy Generation",[60,1002,1003,1004,1009],{},"There are special web crawlers that have been created to crawl all of the links on your domain, in an attempt to generate a valid CSP policy automatically. ",[53,1005,1008],{"href":1006,"rel":1007,"target":149},"https:\u002F\u002Fgithub.com\u002FKennysan\u002FCSPTools",[146,147,148],"CSP Tools"," is one such project on GitHub, which given a list of URL's can crawl the web pages and generate a CSP policy. Another approach the tool uses is to look at your CSP violation error reports and come up with rules based on these.",[60,1011,1012],{},"Be careful using this approach however, it may not catch everything. The best approach is to build up your CSP policy as you build your site from the ground up and then carry out some testing to make sure you have got it right. You can set the CSP policy to report only mode, so that browsers don't actually block anything but do report CSP violation errors, once you are happy that no violations are being reported, you can apply your policy. Finally, you need to keep an eye out for CSP violation errors if they do occur and get them fixed as soon as you see them.",[177,1014,1016,1023],{"id":1015},"testing-csp-policies",[53,1017,1019],{"href":1018,"aria-hidden":123},"#testing-csp-policies",[125,1020,1021],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,1022],{"fill":135,"fill-rule":136,"d":137},"Testing CSP Policies",[60,1025,295,1026,1031],{},[53,1027,1030],{"href":1028,"rel":1029,"target":149},"https:\u002F\u002Fchrome.google.com\u002Fwebstore\u002Fdetail\u002Fcsp-tester\u002Fehmipebdmhlmikaopdfoinmcjhhfadlf",[146,147,148],"CSP Tester"," Chrome extension is an example of a tool you can use to apply CSP policies to your site and view the effects in the browser console window.",[60,1033,1034,1035,1037,1038,1040,1041,1043],{},"As I've mentioned before, the best way is to build CSP into your site as you build your site. You can use the ",[192,1036,334],{}," directive to log any violations and get them fixed. You can also use the ",[192,1039,449],{}," HTTP header instead of ",[192,1042,194],{},", to stop the browser from actually blocking anything if you are not confident in the level of testing you have done.",[117,1045,1047,1054],{"id":1046},"conclusions",[53,1048,1050],{"href":1049,"aria-hidden":123},"#conclusions",[125,1051,1052],{"xmlns":127,"xmlns:xlink":128,"viewBox":129,"version":130,"width":131,"height":131,"aria-hidden":123},[133,1053],{"fill":135,"fill-rule":136,"d":137},"Conclusions",[60,1056,1057,1058,1061],{},"Wow, that was a long blog post. I wanted it to be as comprehensive as possible. I hope I've shown that now is the time to invest in implementing CSP and if you are developing a new site, then integrating CSP into it at an early stage will mean that you reap the benefits of a much greater level of security. The ",[53,1059,56],{"href":198,"rel":1060,"target":149},[146,147,148]," project template is a great place to start and will give you a working code example which tells a thousand words on its own.",[1063,1064,1065],"style",{},"html pre.shiki code .sNflI, html code.shiki .sNflI{--shiki-default:#800000;--shiki-dark:#F8F8F2}html pre.shiki code .sjbfc, html code.shiki .sjbfc{--shiki-default:#800000;--shiki-dark:#F92672}html pre.shiki code .snDo4, html code.shiki .snDo4{--shiki-default:#E50000;--shiki-dark:#A6E22E}html pre.shiki code .sjLUg, html code.shiki .sjLUg{--shiki-default:#000000;--shiki-dark:#F8F8F2}html pre.shiki code .squEy, html code.shiki .squEy{--shiki-default:#0000FF;--shiki-dark:#E6DB74}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s1q82, html code.shiki .s1q82{--shiki-default:#008000;--shiki-dark:#88846F}html pre.shiki code .sFrd5, html code.shiki .sFrd5{--shiki-default:#001080;--shiki-dark:#F8F8F2}html pre.shiki code .sWm5y, html code.shiki .sWm5y{--shiki-default:#795E26;--shiki-dark:#A6E22E}html pre.shiki code .sJvqV, html code.shiki .sJvqV{--shiki-default:#0000FF;--shiki-dark:#F92672}html pre.shiki code .sw29p, html code.shiki .sw29p{--shiki-default:#267F99;--shiki-default-text-decoration:inherit;--shiki-dark:#A6E22E;--shiki-dark-text-decoration:underline}html pre.shiki code .snCLD, html code.shiki .snCLD{--shiki-default:#000000;--shiki-dark:#F92672}html pre.shiki code .sMc8R, html code.shiki .sMc8R{--shiki-default:#0000FF;--shiki-dark:#AE81FF}html pre.shiki code .swiDo, html code.shiki .swiDo{--shiki-default:#A31515;--shiki-dark:#E6DB74}html pre.shiki code .s4J9F, html code.shiki .s4J9F{--shiki-default:#0000FF;--shiki-default-font-style:inherit;--shiki-dark:#66D9EF;--shiki-dark-font-style:italic}html pre.shiki code .smL5M, html code.shiki .smL5M{--shiki-default:#AF00DB;--shiki-dark:#F92672}html pre.shiki code .sK46n, html code.shiki .sK46n{--shiki-default:#0000FF;--shiki-dark:#FD971F}html pre.shiki code .svrZB, html code.shiki .svrZB{--shiki-default:#0451A5;--shiki-default-font-style:inherit;--shiki-dark:#66D9EF;--shiki-dark-font-style:italic}html pre.shiki code .syaXe, html code.shiki .syaXe{--shiki-default:#A31515;--shiki-dark:#CFCFC2}html pre.shiki code .s0PsH, html code.shiki .s0PsH{--shiki-default:#098658;--shiki-dark:#AE81FF}",{"title":219,"searchDepth":1067,"depth":1067,"links":1068},2,[],{"issue":1070,"comments":1074},{"number":1071,"title":1072,"html_url":1073},67,"[Comment] Content Security Policy (CSP) for ASP.NET MVC","https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67",[1075,1087,1095,1103,1112,1120,1128,1136,1144,1152,1160,1168,1176,1188],{"id":1076,"html_url":1077,"body_html":1078,"created_at":1079,"updated_at":1079,"author_association":1080,"user":1081,"reactions":1085},627251422,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251422","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F0d8f976457f65401311084c0f24a33e58b9be876d49f21df33f583876aa255fe\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32323735316533636361643335393336386262336265623330663834646433323f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Daniel\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F0d8f976457f65401311084c0f24a33e58b9be876d49f21df33f583876aa255fe\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32323735316533636361643335393336386262336265623330663834646433323f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Daniel\u003C\u002Fstrong> commented on \u003Cstrong>2017-08-31 13:26:25\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Thank you so much for the time you put into writing this!\u003Cbr \u002F>\nYou're awesome.\u003C\u002Fp>","2020-05-12T10:19:50Z","OWNER",{"login":1082,"avatar_url":1083,"html_url":1084},"RehanSaeed","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F2270364?v=4","https:\u002F\u002Fgithub.com\u002FRehanSaeed",{"url":1086,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251422\u002Freactions",{"id":1088,"html_url":1089,"body_html":1090,"created_at":1091,"updated_at":1091,"author_association":1080,"user":1092,"reactions":1093},627251485,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251485","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fb22bf23135618dda1265e96eea984dd270936c03a5c2d399bb5fd04182b7f6f4\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f33343661373235663537643063616666653162613236353531333564326238383f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Alex\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fb22bf23135618dda1265e96eea984dd270936c03a5c2d399bb5fd04182b7f6f4\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f33343661373235663537643063616666653162613236353531333564326238383f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Alex\u003C\u002Fstrong> commented on \u003Cstrong>2017-10-17 20:04:58\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Excellent article! Was looking for some good explanations on NWebsec and CSP. Thank you.\u003C\u002Fp>","2020-05-12T10:19:58Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1094,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251485\u002Freactions",{"id":1096,"html_url":1097,"body_html":1098,"created_at":1099,"updated_at":1099,"author_association":1080,"user":1100,"reactions":1101},627251551,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251551","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F33c3f2ace8a27f2a95a9db9a1d4720229302ba8aba35ebe0fdfb23da5f564864\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32356463663161333465646235386630633737343263333239376434333533353f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Mahesh\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F33c3f2ace8a27f2a95a9db9a1d4720229302ba8aba35ebe0fdfb23da5f564864\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32356463663161333465646235386630633737343263333239376434333533353f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Mahesh\u003C\u002Fstrong> commented on \u003Cstrong>2018-03-21 17:00:09\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>This helped me to overcome the SignalR issue I had. Nice article and I am glad I found this straight away without wasting time.\u003C\u002Fp>","2020-05-12T10:20:06Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1102,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251551\u002Freactions",{"id":1104,"html_url":1105,"body_html":1106,"created_at":1107,"updated_at":1108,"author_association":1080,"user":1109,"reactions":1110},627251612,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251612","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fa116a0e64108d38fa385577f25176a26f43c97a493a38340c9cd2e6ee032cee9\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f65343232306465626163386330663165653432653066383861353135643638633f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Daniel Ávila Méndez\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fa116a0e64108d38fa385577f25176a26f43c97a493a38340c9cd2e6ee032cee9\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f65343232306465626163386330663165653432653066383861353135643638633f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Daniel Ávila Méndez\u003C\u002Fstrong> commented on \u003Cstrong>2018-04-26 21:59:24\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>I'm trying use NWebsec setting \u003Ccode>script-src\u003C\u002Fcode> nonce in \u003Ccode>add\u003C\u002Fcode> tag inside (\u003Ccode>web.config\u003C\u002Fcode>), but in response, nonce appears without single quote (required). I'm using ASP.NET MVC (.NET Framework 4.5). Please help\u003C\u002Fp>","2020-05-12T10:20:13Z","2020-05-12T11:59:10Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1111,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251612\u002Freactions",{"id":1113,"html_url":1114,"body_html":1115,"created_at":1116,"updated_at":1116,"author_association":1080,"user":1117,"reactions":1118},627251681,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251681","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Muhammad Rehan Saeed\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\u002F\u002Frehansaeed.com\u002F\">Muhammad Rehan Saeed\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2018-04-27 09:25:18\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>I'm trying use NWebsec setting \u003Ccode>script-src\u003C\u002Fcode> nonce in \u003Ccode>add\u003C\u002Fcode> tag inside (\u003Ccode>web.config\u003C\u002Fcode>), but in response, nonce appears without single quote (required). I'm using ASP.NET MVC (.NET Framework 4.5). Please help\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Try posting an issue in the NWebSec GitHub issues.\u003C\u002Fp>","2020-05-12T10:20:21Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1119,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251681\u002Freactions",{"id":1121,"html_url":1122,"body_html":1123,"created_at":1124,"updated_at":1124,"author_association":1080,"user":1125,"reactions":1126},627251738,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251738","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fed1a474d1acd6ad6c48f7f7ae1c52874071196c4c2b60f6bd0dbd7d3038ce1a3\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f37616233343566373165643462333736666131643465383430643266316565383f733d393626643d6d6d26723d67\">\u003Cimg alt=\"shiloh\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fed1a474d1acd6ad6c48f7f7ae1c52874071196c4c2b60f6bd0dbd7d3038ce1a3\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f37616233343566373165643462333736666131643465383430643266316565383f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>shiloh\u003C\u002Fstrong> commented on \u003Cstrong>2018-10-22 20:55:38\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Did hashes ever get added to the NWebSec library?\u003C\u002Fp>","2020-05-12T10:20:29Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1127,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251738\u002Freactions",{"id":1129,"html_url":1130,"body_html":1131,"created_at":1132,"updated_at":1132,"author_association":1080,"user":1133,"reactions":1134},627251811,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251811","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Muhammad Rehan Saeed\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\u002F\u002Frehansaeed.com\u002F\">Muhammad Rehan Saeed\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2018-10-23 09:47:11\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>Did hashes ever get added to the NWebSec library?\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>No, I don't think so. Feel free to raise an issue on that project.\u003C\u002Fp>","2020-05-12T10:20:37Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1135,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251811\u002Freactions",{"id":1137,"html_url":1138,"body_html":1139,"created_at":1140,"updated_at":1140,"author_association":1080,"user":1141,"reactions":1142},627251892,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251892","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fbc15fb661201d4859f7e115148009b0c838a5fb4601b408016684a04110a33d2\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f62343638376662663337306336346566613332303133363432383434666562383f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Qamaruddin\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fbc15fb661201d4859f7e115148009b0c838a5fb4601b408016684a04110a33d2\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f62343638376662663337306336346566613332303133363432383434666562383f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Qamaruddin\u003C\u002Fstrong> commented on \u003Cstrong>2018-12-20 09:59:50\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Thanks for going in-dept into CSP.\u003C\u002Fp>\n\u003Cp>Are there any new updates to CSP which can be added to this blog.\u003C\u002Fp>","2020-05-12T10:20:45Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1143,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251892\u002Freactions",{"id":1145,"html_url":1146,"body_html":1147,"created_at":1148,"updated_at":1148,"author_association":1080,"user":1149,"reactions":1150},627251944,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627251944","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Muhammad Rehan Saeed\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\u002F\u002Frehansaeed.com\u002F\">Muhammad Rehan Saeed\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2018-12-20 10:35:30\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>Thanks for going in-dept into CSP.\u003C\u002Fp>\n\u003Cp>Are there any new updates to CSP which can be added to this blog.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>There are new versions of CSP with added features. I recommend doing some reading on the Mozilla site.\u003C\u002Fp>","2020-05-12T10:20:53Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1151,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627251944\u002Freactions",{"id":1153,"html_url":1154,"body_html":1155,"created_at":1156,"updated_at":1156,"author_association":1080,"user":1157,"reactions":1158},627252000,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627252000","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fc2f0d65f36dc884198255b7d8605ecc63144532bd606e4cfc9ad49bee216735f\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f65366263363732623162616433653663623266636163356535346431626535633f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Fabian Mitchell\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002Fc2f0d65f36dc884198255b7d8605ecc63144532bd606e4cfc9ad49bee216735f\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f65366263363732623162616433653663623266636163356535346431626535633f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>Fabian Mitchell\u003C\u002Fstrong> commented on \u003Cstrong>2019-02-08 03:37:27\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Just want to express my gratitude to you for writing this article. Helped solve my current problem really quickly. Cheers\u003C\u002Fp>","2020-05-12T10:21:01Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1159,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627252000\u002Freactions",{"id":1161,"html_url":1162,"body_html":1163,"created_at":1164,"updated_at":1164,"author_association":1080,"user":1165,"reactions":1166},627252084,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627252084","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F6ac42c3a2f9adad43ef8cdce097eb7f7adcb50552887d4e39092f8738aea1d5f\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f30613865633064653562333362323634633039313036653435396530316137313f733d393626643d6d6d26723d67\">\u003Cimg alt=\"jaipal\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F6ac42c3a2f9adad43ef8cdce097eb7f7adcb50552887d4e39092f8738aea1d5f\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f30613865633064653562333362323634633039313036653435396530316137313f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>jaipal\u003C\u002Fstrong> commented on \u003Cstrong>2019-07-03 04:40:42\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Can I implement csp header with meta tag in asp.net mvc..\u003Cbr \u002F>\nI don't want to use nwebsec nuget package\u003C\u002Fp>","2020-05-12T10:21:10Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1167,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627252084\u002Freactions",{"id":1169,"html_url":1170,"body_html":1171,"created_at":1172,"updated_at":1172,"author_association":1080,"user":1173,"reactions":1174},627252141,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-627252141","\n\u003Cp>\u003Ca target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\">\u003Cimg alt=\"Muhammad Rehan Saeed\" height=\"40\" width=\"40\" src=\"https:\u002F\u002Fcamo.githubusercontent.com\u002F8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca\u002F68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67\" \u002F>\u003C\u002Fa> \u003Cstrong>\u003Ca rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\u002F\u002Frehansaeed.com\u002F\">Muhammad Rehan Saeed\u003C\u002Fa>\u003C\u002Fstrong> commented on \u003Cstrong>2019-07-16 10:16:00\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>Can I implement csp header with meta tag in asp.net mvc..\u003Cbr \u002F>\nI don't want to use nwebsec nuget package\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Yes you can.\u003C\u002Fp>","2020-05-12T10:21:17Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1175,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F627252141\u002Freactions",{"id":1177,"html_url":1178,"body_html":1179,"created_at":1180,"updated_at":1180,"author_association":1181,"user":1182,"reactions":1186},664968521,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-664968521","\u003Cp>Hello Rehan Saeed,\u003C\u002Fp>\n\u003Cp>Thanks by this great article.\u003Cbr \u002F>\nI still have a question: Why do you use \"style-src 'self' 'unsafe-inline';\" in your content security police?\u003C\u002Fp>\n\u003Cp>In this moment, i'm trying to use \"style-src 'self'\". I'm having an issue on style-src police when I perform validation on server side and add an error to my model.. It seems there is some limitation on asp.net mvc.\u003C\u002Fp>","2020-07-28T10:44:35Z","NONE",{"login":1183,"avatar_url":1184,"html_url":1185},"nnunes10","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F13276122?v=4","https:\u002F\u002Fgithub.com\u002Fnnunes10",{"url":1187,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F664968521\u002Freactions",{"id":1189,"html_url":1190,"body_html":1191,"created_at":1192,"updated_at":1192,"author_association":1080,"user":1193,"reactions":1194},665057652,"https:\u002F\u002Fgithub.com\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002F67#issuecomment-665057652","\u003Cblockquote>\n\u003Cp>I still have a question: Why do you use \"style-src 'self' 'unsafe-inline';\" in your content security police?\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>In this case, you'd use \u003Ccode>unsafe-inline\u003C\u002Fcode> to include CSS directly in your HTML.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>In this moment, i'm trying to use \"style-src 'self'\". I'm having an issue on style-src police when I perform validation on server side and add an error to my model.. It seems there is some limitation on asp.net mvc.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Not certain I can help you with that. I'd suggest posting a question on StackOverflow with a clear, concise and small example.\u003C\u002Fp>","2020-07-28T14:00:14Z",{"login":1082,"avatar_url":1083,"html_url":1084},{"url":1195,"total_count":4,"+1":4,"-1":4,"laugh":4,"hooray":4,"confused":4,"heart":4,"rocket":4,"eyes":4},"https:\u002F\u002Fapi.github.com\u002Frepos\u002FRehanSaeed\u002Frehansaeed.github.io\u002Fissues\u002Fcomments\u002F665057652\u002Freactions","2015-03-17T00:00:00+00:00",null,"Content Security Policy (CSP) is a HTTP header which white-lists content the browser is allowed to load. This post discusses its application in ASP.NET MVC.","md",[1201,1203,1204,1205,1207,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1223,1224,1225,1226],{"depth":1202,"value":138},1,{"depth":1067,"value":187},{"depth":1067,"value":271},{"depth":1206,"value":292},3,{"depth":1206,"value":329},{"depth":1206,"value":360},{"depth":1206,"value":393},{"depth":1067,"value":440},{"depth":1202,"value":464},{"depth":1202,"value":581},{"depth":1202,"value":633},{"depth":1067,"value":685},{"depth":1067,"value":735},{"depth":1202,"value":770},{"depth":1067,"value":784},{"depth":1067,"value":830},{"depth":1202,"value":860},{"depth":1202,"value":918},{"depth":1067,"value":938},{"depth":1067,"value":969},{"depth":1067,"value":986},{"depth":1067,"value":1000},{"depth":1067,"value":1023},{"depth":1202,"value":1054},"\u002Fimages\u002Fhero\u002FContent-Security-Policy-CSP-for-ASP.NET-MVC-1366x768.png",{},true,"posts\u002F2015\u002Fcontent-security-policy-for-asp-net-mvc\u002Findex",[1232,1233,56,1234,1235,1236,1237,1238,1239,713],".NET","ASP.NET","C#","Content Security Policy","Cross Site Scripting","CSP","Fiddler","MVC",{"left":4,"top":4,"width":26,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1241},"\u003Cpath fill=\"currentColor\" d=\"M352 320c-22.608 0-43.387 7.819-59.79 20.895l-102.486-64.054a96.55 96.55 0 0 0 0-41.683l102.486-64.054C308.613 184.181 329.392 192 352 192c53.019 0 96-42.981 96-96S405.019 0 352 0s-96 42.981-96 96c0 7.158.79 14.13 2.276 20.841L155.79 180.895C139.387 167.819 118.608 160 96 160c-53.019 0-96 42.981-96 96s42.981 96 96 96c22.608 0 43.387-7.819 59.79-20.895l102.486 64.054A96.3 96.3 0 0 0 256 416c0 53.019 42.981 96 96 96s96-42.981 96-96s-42.981-96-96-96\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1243},"\u003Cpath fill=\"currentColor\" d=\"M504 256C504 119 393 8 256 8S8 119 8 256c0 123.78 90.69 226.38 209.25 245V327.69h-63V256h63v-54.64c0-62.15 37-96.48 93.67-96.48c27.14 0 55.52 4.84 55.52 4.84v61h-31.28c-30.8 0-40.41 19.12-40.41 38.73V256h68.78l-11 71.69h-57.78V501C413.31 482.38 504 379.78 504 256\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1245},"\u003Cpath fill=\"currentColor\" d=\"M459.37 151.716c.325 4.548.325 9.097.325 13.645c0 138.72-105.583 298.558-298.558 298.558c-59.452 0-114.68-17.219-161.137-47.106c8.447.974 16.568 1.299 25.34 1.299c49.055 0 94.213-16.568 130.274-44.832c-46.132-.975-84.792-31.188-98.112-72.772c6.498.974 12.995 1.624 19.818 1.624c9.421 0 18.843-1.3 27.614-3.573c-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319c-28.264-18.843-46.781-51.005-46.781-87.391c0-19.492 5.197-37.36 14.294-52.954c51.655 63.675 129.3 105.258 216.365 109.807c-1.624-7.797-2.599-15.918-2.599-24.04c0-57.828 46.782-104.934 104.934-104.934c30.213 0 57.502 12.67 76.67 33.137c23.715-4.548 46.456-13.32 66.599-25.34c-7.798 24.366-24.366 44.833-46.132 57.827c21.117-2.273 41.584-8.122 60.426-16.243c-14.292 20.791-32.161 39.308-52.628 54.253\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1247},"\u003Cpath fill=\"currentColor\" d=\"M201.5 305.5c-13.8 0-24.9-11.1-24.9-24.6c0-13.8 11.1-24.9 24.9-24.9c13.6 0 24.6 11.1 24.6 24.9c0 13.6-11.1 24.6-24.6 24.6M504 256c0 137-111 248-248 248S8 393 8 256S119 8 256 8s248 111 248 248m-132.3-41.2c-9.4 0-17.7 3.9-23.8 10c-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3l55.4 12.5c0 13.6 11.1 24.6 24.6 24.6c13.8 0 24.9-11.3 24.9-24.9s-11.1-24.9-24.9-24.9c-9.7 0-18 5.8-22.1 13.8l-61.2-13.6c-3-.8-6.1 1.4-6.9 4.4l-19.1 86.4c-33.2 1.4-63.1 11.3-85.5 26.8c-6.1-6.4-14.7-10.2-24.1-10.2c-34.9 0-46.3 46.9-14.4 62.8c-1.1 5-1.7 10.2-1.7 15.5c0 52.6 59.2 95.2 132 95.2c73.1 0 132.3-42.6 132.3-95.2c0-5.3-.6-10.8-1.9-15.8c31.3-16 19.8-62.5-14.9-62.5M302.8 331c-18.2 18.2-76.1 17.9-93.6 0c-2.2-2.2-6.1-2.2-8.3 0c-2.5 2.5-2.5 6.4 0 8.6c22.8 22.8 87.3 22.8 110.2 0c2.5-2.2 2.5-6.1 0-8.6c-2.2-2.2-6.1-2.2-8.3 0m7.7-75c-13.6 0-24.6 11.1-24.6 24.9c0 13.6 11.1 24.6 24.6 24.6c13.8 0 24.9-11.1 24.9-24.6c0-13.8-11-24.9-24.9-24.9\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1249},"\u003Cpath fill=\"currentColor\" d=\"M512 194.8c0 101.3-82.4 183.8-183.8 183.8c-101.7 0-184.4-82.4-184.4-183.8c0-101.6 82.7-184.3 184.4-184.3C429.6 10.5 512 93.2 512 194.8M0 501.5h90v-491H0z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":1251},"\u003Cpath fill=\"currentColor\" d=\"m20.216 6.415l-.132-.666c-.119-.598-.388-1.163-1.001-1.379c-.197-.069-.42-.098-.57-.241c-.152-.143-.196-.366-.231-.572c-.065-.378-.125-.756-.192-1.133c-.057-.325-.102-.69-.25-.987c-.195-.4-.597-.634-.996-.788a6 6 0 0 0-.626-.194c-1-.263-2.05-.36-3.077-.416a26 26 0 0 0-3.7.062c-.915.083-1.88.184-2.75.5c-.318.116-.646.256-.888.501c-.297.302-.393.77-.177 1.146c.154.267.415.456.692.58c.36.162.737.284 1.123.366c1.075.238 2.189.331 3.287.37q1.829.074 3.65-.118q.449-.05.896-.119c.352-.054.578-.513.474-.834c-.124-.383-.457-.531-.834-.473c-.466.074-.96.108-1.382.146q-1.767.12-3.536.006a22 22 0 0 1-1.157-.107c-.086-.01-.18-.025-.258-.036q-.364-.055-.724-.13c-.111-.027-.111-.185 0-.212h.005q.416-.09.838-.147h.002c.131-.009.263-.032.394-.048a25 25 0 0 1 3.426-.12q1.011.029 2.017.144l.228.031q.4.06.798.145c.392.085.895.113 1.07.542c.055.137.08.288.111.431l.319 1.484a.237.237 0 0 1-.199.284h-.003l-.112.015a37 37 0 0 1-4.743.295a37 37 0 0 1-4.699-.304c-.14-.017-.293-.042-.417-.06c-.326-.048-.649-.108-.973-.161c-.393-.065-.768-.032-1.123.161c-.29.16-.527.404-.675.701c-.154.316-.199.66-.267 1c-.069.34-.176.707-.135 1.056c.087.753.613 1.365 1.37 1.502a39.7 39.7 0 0 0 11.343.376a.483.483 0 0 1 .535.53l-.071.697l-1.018 9.907c-.041.41-.047.832-.125 1.237c-.122.637-.553 1.028-1.182 1.171q-.868.197-1.756.205c-.656.004-1.31-.025-1.966-.022c-.699.004-1.556-.06-2.095-.58c-.475-.458-.54-1.174-.605-1.793l-.731-7.013l-.322-3.094c-.037-.351-.286-.695-.678-.678c-.336.015-.718.3-.678.679l.228 2.185l.949 9.112c.147 1.344 1.174 2.068 2.446 2.272c.742.12 1.503.144 2.257.156c.966.016 1.942.053 2.892-.122c1.408-.258 2.465-1.198 2.616-2.657l1.024-9.995l.215-2.087a.48.48 0 0 1 .39-.426c.402-.078.787-.212 1.074-.518c.455-.488.546-1.124.385-1.766zm-1.478.772c-.145.137-.363.201-.578.233c-2.416.359-4.866.54-7.308.46c-1.748-.06-3.477-.254-5.207-.498c-.17-.024-.353-.055-.47-.18c-.22-.236-.111-.71-.054-.995c.052-.26.152-.609.463-.646c.484-.057 1.046.148 1.526.22q.865.132 1.737.212c2.48.226 5.002.19 7.472-.14q.675-.09 1.345-.21c.399-.072.84-.206 1.08.206c.166.281.188.657.162.974a.54.54 0 0 1-.169.364zm-6.159 3.9c-.862.37-1.84.788-3.109.788a6 6 0 0 1-1.569-.217l.877 9.004c.065.78.717 1.38 1.5 1.38c0 0 1.243.065 1.658.065c.447 0 1.786-.065 1.786-.065c.783 0 1.434-.6 1.499-1.38l.94-9.95a4 4 0 0 0-1.322-.238c-.826 0-1.491.284-2.26.613\"\u002F>",{"left":4,"top":4,"width":29,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1253},"\u003Cpath fill=\"currentColor\" d=\"M111.4 295.9c-3.5 19.2-17.4 108.7-21.5 134c-.3 1.8-1 2.5-3 2.5H12.3c-7.6 0-13.1-6.6-12.1-13.9L58.8 46.6c1.5-9.6 10.1-16.9 20-16.9c152.3 0 165.1-3.7 204 11.4c60.1 23.3 65.6 79.5 44 140.3c-21.5 62.6-72.5 89.5-140.1 90.3c-43.4.7-69.5-7-75.3 24.2M357.1 152c-1.8-1.3-2.5-1.8-3 1.3c-2 11.4-5.1 22.5-8.8 33.6c-39.9 113.8-150.5 103.9-204.5 103.9c-6.1 0-10.1 3.3-10.9 9.4c-22.6 140.4-27.1 169.7-27.1 169.7c-1 7.1 3.5 12.9 10.6 12.9h63.5c8.6 0 15.7-6.3 17.4-14.9c.7-5.4-1.1 6.1 14.4-91.3c4.6-22 14.3-19.7 29.3-19.7c71 0 126.4-28.8 142.9-112.3c6.5-34.8 4.6-71.4-23.8-92.6\"\u002F>",{"left":4,"top":4,"width":18,"height":18,"rotate":4,"vFlip":6,"hFlip":6,"body":1255},"\u003Cpath fill=\"currentColor\" d=\"M256 8C119.043 8 8 119.083 8 256c0 136.997 111.043 248 248 248s248-111.003 248-248C504 119.083 392.957 8 256 8m0 448c-110.532 0-200-89.431-200-200c0-110.495 89.472-200 200-200c110.491 0 200 89.471 200 200c0 110.53-89.431 200-200 200m107.244-255.2c0 67.052-72.421 68.084-72.421 92.863V300c0 6.627-5.373 12-12 12h-45.647c-6.627 0-12-5.373-12-12v-8.659c0-35.745 27.1-50.034 47.579-61.516c17.561-9.845 28.324-16.541 28.324-29.579c0-17.246-21.999-28.693-39.784-28.693c-23.189 0-33.894 10.977-48.942 29.969c-4.057 5.12-11.46 6.071-16.666 2.124l-27.824-21.098c-5.107-3.872-6.251-11.066-2.644-16.363C184.846 131.491 214.94 112 261.794 112c49.071 0 101.45 38.304 101.45 88.8M298 368c0 23.159-18.841 42-42 42s-42-18.841-42-42s18.841-42 42-42s42 18.841 42 42\"\u002F>",1792951301532]