Hi,
I am trying to upgrade one of our sites, the oroginal developers added this to program.
app.Use(async (context, next) =>
{
context.Response.OnStarting(() =>
{
var isUmbraco = context.Request.IsBackOfficeRequest();
if (isUmbraco == false)
{
//string nonceValue = "approach1";
// public web page
// apply standard csp and nonce
//var rng = RandomNumberGenerator.Create();
//var nonceBytes = new byte[32];
//rng.GetBytes(nonceBytes);
//var nonce = Convert.ToBase64String(nonceBytes);
string csp = customSection.GetValue<string>("Content-Security-Policy");
csp = csp.Replace("{injectMe}", nonce);
context.Items.Add("ScriptNonce2", nonce);
context.Response.HttpContext.Items.Add("ScriptNonce1", nonce);
context.Response.Headers.Add("Content-Security-Policy", csp);
}
else
{
// it's umbraco, apply less strict csp
string csp = customSection.GetValue<string>("Content-Security-Policy-Umbraco").ToString();
context.Response.Headers.Add("Content-Security-Policy", new[] { csp });
}
return Task.FromResult(0);
});
await next();
}
I can’t work out how to get this in to 17. It keeps generating an error at await next().
Any pointers on how to fix this.
Thanks
Darren
