Umbraco CSP (Umbraco.Community.CSPManager)

Questions
1

Hi,

I have installed the package Umbraco.Community.CSPManager

Screenshot 2026-04-30 142318
Screenshot 2026-04-30 1423181919Ă—301 11.8 KB

I am seeing the Migration for Umbraco.Community.CSPManager but I am not seeing the other section of the CSP Manager.

3
3445Ă—319 16.6 KB

Can any one advise please, I have done a clean, build and rebuild and it not showing any options for the CSP Manager. (I have also deleted all the files in UmbracoCMS\bin\Debug\net10.0) but it still not showing.

2

If it’s a seperate section, you need to explicitly add that section to the user role, otherwise you won’t see it :slight_smile: Otherwise @MattW might be able to help you further :slight_smile:

3

Hi @darrenhunterEmerald

Is which version of CSP manager have you installed? For Umbraco 17+ you need to use the v17 version of CSP manager.

I ask as a similar issue was raised and that was the issue

Thanks
Matt

4

Screenshot 2026-04-30 144625
Screenshot 2026-04-30 1446251483Ă—763 29.3 KB

Screenshot 2026-04-30 144721
Screenshot 2026-04-30 1447211490Ă—680 45 KB

Here the info you asked for.

5

Mmm interesting… Is the section available in the user groups section?

I’ll hopefully have my PC back for the weekend to investigate further.

Thanks
Matt

6

Thank you for taking a look,

Here what I am seeing in the user group section:

a2
a21919Ă—990 66.4 KB

a1
a11911Ă—639 53.7 KB

Hope this helps!

7

I also added this to my app.json file

 "CspManager": {
   "DisableBackOfficeHeader": false
 },

I tried it with both true and false set and still nothing showing up.
8

I installed version 17.0.0 on a fresh Umbraco 17.3.4. I think the issue is that the client side stuff is not packed properly. I get absolutely no extensions from the CSP manager in the extension insights:

image
image869Ă—699 31.2 KB

9

@MattW I looked at the source, I think you need to add this to the project file of Umbraco.Community.CSPManager. Otherwise the client files will not be at the correct location for Umbraco to pick it up:

<ContentTargetFolders>.</ContentTargetFolders>

Edit:
Hmm, that’s not all that’s needed. Currently, the static web assets are not in the package at all:

image
image433Ă—204 4.18 KB

10

Thanks Luuk not sure, what’s changed as the beta was working…

11

AI says:

Hi! I investigated why the NuGet package installs but the Umbraco extensions are not visible in backoffice.

What is happening

The package currently builds the frontend via an MSBuild target in:

src/Umbraco.Community.CSPManager/Umbraco.Community.CSPManager.csproj

XML

<Target Name="BuildClient" BeforeTargets="AssignTargetPaths" ...>
  <Exec Command="npm run build" WorkingDirectory="Client" />
</Target>

Vite outputs correctly to:

wwwroot/App_Plugins/UmbracoCommunityCSPManager/

But in the produced .nupkg, static web assets are missing entirely (confirmed by inspecting the package).

Why this causes the backoffice UI to disappear

Umbraco extension discovery depends on:

  • App_Plugins/UmbracoCommunityCSPManager/umbraco-package.json

  • JS bundle files in the same folder

If those are not included in the NuGet package, Umbraco can’t discover/register the bundle, so the section/extensions don’t show up.

Why beta likely worked

There was a recent build-flow change (commit 8916174):

  • moved client build into MSBuild targets

  • removed separate npm build steps in CI

That changed when frontend assets are generated relative to pack/static-web-assets collection.
Current target hook (BeforeTargets="AssignTargetPaths") appears too late for reliable RCL static asset inclusion during dotnet pack, hence missing files in nupkg.

Suggested fix

Run client build earlier in the pipeline that feeds static web asset resolution, e.g.:

  • hook BuildClient to BeforeTargets="ResolveStaticWebAssetsInputs" (or another guaranteed pre-static-assets target)

  • keep it as dependency before pack/nuspec generation

Example:

XML

<Target Name="RestoreClient"
        Inputs="Client\package.json;Client\package-lock.json"
        Outputs="Client\node_modules\.package-lock.json">
  <Exec Command="npm ci" WorkingDirectory="Client" />
</Target>

<Target Name="BuildClient"
        BeforeTargets="ResolveStaticWebAssetsInputs"
        DependsOnTargets="RestoreClient"
        Inputs="@(ClientAssetsInputs)"
        Outputs="$(IntermediateOutputPath)client-build.stamp">
  <Exec Command="npm run build" WorkingDirectory="Client" />
  <Touch Files="$(IntermediateOutputPath)client-build.stamp" AlwaysCreate="true" />
</Target>

Optional safety net:

XML

<Target Name="BuildClientForPack"
        BeforeTargets="GenerateNuspec"
        DependsOnTargets="BuildClient" />

Extra note

This line in csproj is not the root issue, but it’s unnecessary/confusing:

XML

<None Include="Client\public\umbraco-package.json" Pack="false" />

The package should rely on the built/copied file in wwwroot/App_Plugins/..., not the source Client/public file.

How to verify after fix

After dotnet pack, inspect .nupkg and confirm it contains static web assets for:

  • App_Plugins/UmbracoCommunityCSPManager/umbraco-package.json

  • App_Plugins/UmbracoCommunityCSPManager/umbraco-community-csp-manager.js

If those are present, extensions should be discoverable again in Umbraco.

13

Thanks Luuk, my pipeline should be handling this, the csproj stuff is just there to save me locally :smiley:

Working on the fix today

1 Like
14

All fixed in 17.0.1 sorry for this a silly mistake I shouldnt be making!

Matt

3 Likes