Add support for CSP hashes

[RehanSaeed]

Here is a really good blog post showing how it can be done.

[MovGP0]

Currently have the issue that some inline styles are not loading properly besides having the .Self() defined. Support for hashes would solve that problem.

There should be support for unsafe inline, and a hash like hash 'sha256-dnk3F1ZGrgh9Kvk9Vn3ptiaFUoFeGRayv9lz2urXGw8='.

[klings]

Note that nonces are already supported, those could perhaps solve the problem?

[MovGP0]

In fact, nonces is what I do. Still would prefer to use hashes instead.

[MovGP0]

Currently, I use the tag helpers. This gets rid of the browser issues, but it is not something that can be configured centrally and requires the usage of ASP.NET MVC. In other projects, it is more tricky to do that, since there might be no MVC at all.

Maybe there is a solution I have missed?

[RehanSaeed]

Pages with hashes in them can be cached, while nonces cannot.

[MovGP0]

I have the issue that a page gets generated by a library that I am using and I am unable to put a nonce on it. The current solution is to allow 'unsafe-inline', but would sleep much better with a hash instead, since it's always the same.

[HugCoder]

This is a big issue right now since many web browsers block inline-scripting as well by ignoring things like safe-inline. How to add hashes to the white list in CustomSources?

I can't find documentation on how to use nonces either, except for using the NWebsec Tag Helpers package.

[troyhunt]

This seems like a bit of a no-brainer, can you allow a hash as a valid value for a script source? Nonces are a halfway-there approach and they're a good start, but it'd be great if NWebSec enabled a stricter definition of what's allowed to run.

[klings]

Yup, it will be added but there are a couple of other things that need to be sorted first.

…

[jmaxxz]

If one does not have many inline scripts the following workaround can be used:

            app.UseCsp(options => options
                .DefaultSources(s => s.Self())
                .ScriptSources(s =>
                {
                    s.Self().CustomSources("https://example.com/foo/lib.js",
                        "https://www.example.com/bar/lib.js");

                    // Force hashes into custom sources. Can't be done with CustomSources(...)
                    // because CustomSources(...) checks if strings are uris
                    s.CustomSources = s.CustomSources.Concat(new [] { "'sha256-...='"});
                })

[klings]

Released

[GSingha]

If one does not have many inline scripts the following workaround can be used:

            app.UseCsp(options => options
                .DefaultSources(s => s.Self())
                .ScriptSources(s =>
                {
                    s.Self().CustomSources("https://example.com/foo/lib.js",
                        "https://www.example.com/bar/lib.js");

                    // Force hashes into custom sources. Can't be done with CustomSources(...)
                    // because CustomSources(...) checks if strings are uris
                    s.CustomSources = s.CustomSources.Concat(new [] { "'sha256-...='"});
                })

I have added the hashes but still getting the same CSP error. Would you please take a look at the below code snippet:
` app.UseCsp(options => options
.DefaultSources(s => s.Self())
.ScriptSources(s =>
{

                s.Self();
                s.CustomSources("http://localhost:xyz");
                s.CustomSources = s.CustomSources.Concat(new[]
                {

                    "'sha256-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx='",
                    "'sha256-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx='",
                    "'sha256-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx='"

                });
                s.CustomSources = s.CustomSources.Where(x => x != "http://localhost:xyz").ToList();
            })

            .StyleSources(c =>
            {

                c.Self();
                c.CustomSources("http://localhost:xyz");
                c.CustomSources = c.CustomSources.Concat(new[]
                {
                    "'sha256-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx='",
                    "'sha256-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx='",
                    "'sha256-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx='"
               });
                c.CustomSources = c.CustomSources.Where(x => x != "http://localhost:xyz").ToList();
            })
            .ImageSources(i =>
            {
                i.SelfSrc = true;
                i.Self().CustomSources(
                    "http://www.xyz.co.uk",
                    "https://www.xyz.co.uk",
                    "https://*.twitter.com/",
                    "https://*.twimg.com/",
                    "http://*.amazon.com/",
                    "http://*.twitter.com/",
                    "http://*.google-analytics.com",
                    "data:",
                    "https://maps.googleapis.com/",
                    "https://*.gstatic.com/",
                    "http://*.gravatar.com/",
                    "http://*.gravatar.com/",
                    "http://umbraco.tv/media",
                    "https://dashboard.umbraco.org",
                    "https://www.buysubscriptions.com",
                    "https://umbraco.tv"
                   
                    );
            })
            .ConnectSources(c =>
            {
                c.SelfSrc = true;
                c.Self().CustomSources("https://secure.brightcove.com/",
                    "https://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/",
                    "https://xyz1",
                    "https://xyz2");
            })
            .FrameSources(f =>
            {
                f.SelfSrc = true;
                f.Self().CustomSources("https://secure.brightcove.com/",
                    "https://www.youtube.com/embed/",
                    "http://www.youtube.com/embed/",
                    "https://syndication.twitter.com",
                    "https://platform.twitter.com",
                    "https://www.google.com/recaptcha/",
                    "https://www.gstatic.com/recaptcha/",
                    "https://players.brightcove.net/",
                    "https://xyz");
            })
            .FontSources(fn =>
            {
                fn.SelfSrc = true;
                fn.Self().CustomSources("fonts.gstatic.com/s/");

            })
        );`

Erorr Deatils:
For style: refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'sha256-xxxxxxxxxxxxxxxxxxxxx=' ......ither the 'unsafe-inline' keyword, a hash ('sha256-xxxxxxxxxxxxxxxxxxxxxxx='), or a nonce ('nonce-...') is required to enable inline execution.

for Script; Refused to load the script 'http://platform.twitter.com/widgets.js' because it violates the following Content Security Policy directive: "script-src 'self' 'sha256-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx='

Thanks,
Gadadhar

[bkqc]

Where can we find documentation on the hash support?

[AFDevMike]

How To:
https://blog.mozilla.org/security/2014/10/04/csp-for-the-web-we-have/#:~:text=You%E2%80%99d%20have%20a%20CSP%20containing%20a%20hash%2Dsource%20a%20bit%20like%20this%3A