|
|
|
@ -32,7 +32,7 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
|
|
|
|
|
AddHeader(context, "X-Frame-Options", "SAMEORIGIN");
|
|
|
|
|
|
|
|
|
|
var requestAcceptTypeHtml = context.Request.Headers["Accept"].Any(x =>
|
|
|
|
|
x.Contains("text/html") || x.Contains("*/*") || x.Contains("application/xhtml+xml"));
|
|
|
|
|
x!.Contains("text/html") || x.Contains("*/*") || x.Contains("application/xhtml+xml"));
|
|
|
|
|
|
|
|
|
|
var endpoint = context.GetEndpoint();
|
|
|
|
|
|
|
|
|
@ -109,7 +109,7 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
|
|
|
|
|
|
|
|
|
|
protected virtual string BuildContentSecurityPolicyValue(HttpContext context)
|
|
|
|
|
{
|
|
|
|
|
var cspValue = Options.Value.ContentSecurityPolicyValue.IsNullOrWhiteSpace() ? DefaultValue : Options.Value.ContentSecurityPolicyValue;
|
|
|
|
|
var cspValue = Options.Value.ContentSecurityPolicyValue.IsNullOrWhiteSpace() ? DefaultValue : Options.Value.ContentSecurityPolicyValue!;
|
|
|
|
|
if (!(Options.Value.UseContentSecurityPolicyScriptNonce &&
|
|
|
|
|
context.Items.TryGetValue(AbpAspNetCoreConsts.ScriptNonceKey, out var nonce) &&
|
|
|
|
|
nonce is string nonceValue && !string.IsNullOrEmpty(nonceValue)))
|
|
|
|
@ -128,7 +128,7 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var newScriptSrcValue = scriptSrcValue + nonceStr;
|
|
|
|
|
return Options.Value.ContentSecurityPolicyValue.Replace(scriptSrcValue, newScriptSrcValue);
|
|
|
|
|
return Options.Value.ContentSecurityPolicyValue!.Replace(scriptSrcValue!, newScriptSrcValue);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|