2018-10-26 07:22:53 +02:00
|
|
|
|
using System;
|
|
|
|
|
using System.Collections.Generic;
|
|
|
|
|
using System.Linq;
|
|
|
|
|
using System.Threading.Tasks;
|
|
|
|
|
using Microsoft.AspNetCore.Builder;
|
|
|
|
|
using Microsoft.AspNetCore.Http;
|
|
|
|
|
using Teknik.Configuration;
|
|
|
|
|
using Teknik.Utilities;
|
|
|
|
|
|
|
|
|
|
namespace Teknik.IdentityServer.Middleware
|
|
|
|
|
{
|
|
|
|
|
// You may need to install the Microsoft.AspNetCore.Http.Abstractions package into your project
|
|
|
|
|
public class CSPMiddleware
|
|
|
|
|
{
|
|
|
|
|
private readonly RequestDelegate _next;
|
|
|
|
|
|
|
|
|
|
public CSPMiddleware(RequestDelegate next)
|
|
|
|
|
{
|
|
|
|
|
_next = next;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public Task Invoke(HttpContext httpContext, Config config)
|
|
|
|
|
{
|
|
|
|
|
if (!httpContext.Request.IsLocal())
|
|
|
|
|
{
|
|
|
|
|
// Default to nothing allowed
|
|
|
|
|
string allowedDomain = "'none'";
|
|
|
|
|
|
|
|
|
|
// Allow this domain
|
|
|
|
|
string host = httpContext.Request.Headers["Host"];
|
|
|
|
|
|
|
|
|
|
if (!string.IsNullOrEmpty(host))
|
|
|
|
|
{
|
2019-01-27 05:40:18 +01:00
|
|
|
|
string domain = host.GetDomain();
|
2018-10-26 07:22:53 +02:00
|
|
|
|
|
2019-01-27 05:40:18 +01:00
|
|
|
|
allowedDomain = string.Format("*.{0} {0}", domain);
|
|
|
|
|
}
|
|
|
|
|
|
2019-01-26 09:12:39 +01:00
|
|
|
|
var csp = string.Format(
|
2019-01-27 05:40:18 +01:00
|
|
|
|
"default-src 'self'; " +
|
|
|
|
|
"script-src blob: 'unsafe-eval' 'unsafe-inline' {0}; " +
|
2019-01-26 09:12:39 +01:00
|
|
|
|
"style-src 'unsafe-inline' {0}; " +
|
|
|
|
|
"img-src data: *; " +
|
|
|
|
|
"font-src data: {0}; " +
|
|
|
|
|
"connect-src wss: blob: data: {0}; " +
|
|
|
|
|
"media-src *; " +
|
|
|
|
|
"worker-src blob: mediastream: {0}; " +
|
2019-01-27 05:40:18 +01:00
|
|
|
|
"form-action *; " +
|
2019-01-26 09:12:39 +01:00
|
|
|
|
"base-uri {0}; " +
|
|
|
|
|
"frame-ancestors {0};",
|
2019-01-27 05:40:18 +01:00
|
|
|
|
allowedDomain);
|
2018-10-26 07:22:53 +02:00
|
|
|
|
|
|
|
|
|
if (!httpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
|
|
|
|
|
{
|
|
|
|
|
httpContext.Response.Headers.Add("Content-Security-Policy", csp);
|
|
|
|
|
}
|
|
|
|
|
// and once again for IE
|
|
|
|
|
if (!httpContext.Response.Headers.ContainsKey("X-Content-Security-Policy"))
|
|
|
|
|
{
|
|
|
|
|
httpContext.Response.Headers.Add("X-Content-Security-Policy", csp);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return _next(httpContext);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Extension method used to add the middleware to the HTTP request pipeline.
|
|
|
|
|
public static class CSPMiddlewareExtensions
|
|
|
|
|
{
|
|
|
|
|
public static IApplicationBuilder UseCSP(this IApplicationBuilder builder)
|
|
|
|
|
{
|
|
|
|
|
return builder.UseMiddleware<CSPMiddleware>();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|