IdentityServer 4的内容安全问题升级到1.5版

Question

我将我的Identityserver 4升级到1.5.1版本，现在内容安全策略出错了。到目前为止，所有解决方案都没有对我有用 我试过这个

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline' https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.6/css/bootstrap.min.css; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ajax.aspnetcdn.com/ajax/jquery/jquery-2.2.0.min.js https://ajax.aspnetcdn.com/ajax/jquery.validate/1.14.0/jquery.validate.min.js">

但没有什么值得发生的事情

Answer 1

在IdentityServer4 Samples中，类SecurityHeadersAttribute.cs负责发送正确的CSP标头。您只应添加域名：

var csp = "default-src 'self';" +
                      "img-src * 'self' data: https:;" +
                      "style-src 'self' ajax.aspnetcdn.com;" +
                      "font-src 'self' ajax.aspnetcdn.com;" +
                      "script-src 'self' ajax.aspnetcdn.com;"

 // once for standards compliant browsers
 if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
 {
     context.HttpContext.Response.Headers.Add("Content-Security-Policy", csp);
 }
 // and once again for IE
 if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Security-Policy"))
 {
     context.HttpContext.Response.Headers.Add("X-Content-Security-Policy", csp);
 }