reporting-asp-net-core-content-security-policy's Introduction

Reporting for ASP.NET Core - Content Security Policy (CSP)

This example demonstrates how to implement a nonce-based Content Security Policy (CSP) for an ASP.NET Core Application through an HTTP response header.

Use the nonce-based approach to disallow inline script and style execution.

Example Overview

In the HomeController.cs file, generate the nonce value. In this example, the RandomNumberGenerator class is used to generate cryptographically strong random values. Add an HTTP header with the Content Security Policy with nonce for the script-src directive.

The following code snippet shows how to add a nonce-based CSP for the Report Designer component:

//...
public async Task<IActionResult> Designer(
    [FromServices] IReportDesignerClientSideModelGenerator clientSideModelGenerator,
    [FromQuery] string reportName) {

    var nonceBytes = new byte[32];
    using var generator = RandomNumberGenerator.Create();
    generator.GetBytes(nonceBytes);
    var nonce = Convert.ToBase64String(nonceBytes);

    HttpContext.Response.Headers.Add("Content-Security-Policy",
                string.Format("script-src 'self' 'nonce-{0}';", nonce) +
                "img-src data: https: http:;" +
                "style-src 'self';" +
                "connect-src 'self';" +
                "worker-src 'self' blob:;" +
                "frame-src 'self' blob:;"
            );

    Models.ReportDesignerCustomModel model = new Models.ReportDesignerCustomModel();
    model.ReportDesignerModel = await CreateDefaultReportDesignerModel(clientSideModelGenerator, reportName, null);
    model.Nonce = nonce;
    return View(model);
}
//...

The new nonce value is generated each time the page loads.

On the page, pass the nonce value to the Nonce method:

@{
    var designerRender = Html.DevExpress().ReportDesigner("reportDesigner")
        .Height(null)
        .Width(null)
        .Nonce(Model.Nonce)
        .CssClassName("my-reporting-component")
        .Bind(Model.ReportDesignerModel);
    @designerRender.RenderHtml()
}