ASP.NET Core¶

Microsoft's CSP guidance for ASP.NET Core is written around Blazor, and it demonstrates the policy as a <meta> tag. That matters more than it sounds, because a <meta> tag policy cannot report - so if you want violation reports, you need the header instead.

What ASP.NET Core gives you¶

No built-in CSP middleware. You set the header yourself in the request pipeline.
For Blazor, documented starting policies per hosting model, including 'wasm-unsafe-eval' for the client-side Mono runtime and hashes for the framework's own inline scripts.
Blazor Web Apps on .NET 8 and later automatically send Content-Security-Policy: frame-ancestors 'self', configurable via ContentSecurityFrameAncestorsPolicy.
Guidance on resolving violations with either Subresource Integrity - which Microsoft recommends - or a cryptographic nonce.

Setting the header¶

Middleware is the straightforward route, and unlike a <meta> tag it can carry a reporting directive. Your URLs come from the Setup page:

app.Use(async (context, next) =>
{
    context.Response.Headers.Append("Content-Security-Policy-Report-Only",
        "default-src 'self'; script-src 'self' 'report-sha256'; object-src 'none'; " +
        "report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default");
    context.Response.Headers.Append("Reporting-Endpoints",
        "default=\"https://abc123.report-uri.com/a/d/g\"");
    context.Response.Headers.Append("Report-To",
        "{\"group\":\"default\",\"max_age\":31536000,\"endpoints\":[{\"url\":\"https://abc123.report-uri.com/a/d/g\"}],\"include_subdomains\":true}");
    await next();
});

The Reporting-Endpoints and Report-To headers tell the browser where report-to default sends reports, including the CSP Integrity reports that 'report-sha256' turns on.

Things to watch for¶

A <meta> tag policy silently drops report-uri, report-to, frame-ancestors and sandbox. Microsoft's own documentation says so. Every example in their Blazor guide uses a <meta> tag, so it is easy to follow the guidance exactly and end up with a policy that can never tell you what it blocked.
A CSP applied in <head> interferes with local development - Browser Link and the browser refresh script get blocked. Microsoft's fix is to gate the policy on !Env.IsDevelopment().
Blazor Web Apps render an inline import map and, in some versions, an inline onclick handler in the NavMenu component. Both need a hash, a nonce, or to be moved out of line.
If you gate the policy on environment, remember that report-only in production is still production. Ship the report-only header everywhere you would ship the enforcing one.

Official documentation¶

Microsoft - Enforce a Content Security Policy for ASP.NET Core Blazor

Start Monitoring with Report URI¶

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page.

Start your free trial