From 011be558b009cfa37c4f6517f9a8cf2eaa980166 Mon Sep 17 00:00:00 2001 From: guardrex <1622880+guardrex@users.noreply.github.com> Date: Mon, 26 Jan 2026 09:44:50 -0500 Subject: [PATCH 1/3] [11.0 P1] Update CSP guidance for inline JS removal --- .../security/content-security-policy.md | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/aspnetcore/blazor/security/content-security-policy.md b/aspnetcore/blazor/security/content-security-policy.md index 5d402e701ad7..0ff6765f4f36 100644 --- a/aspnetcore/blazor/security/content-security-policy.md +++ b/aspnetcore/blazor/security/content-security-policy.md @@ -51,7 +51,7 @@ The following directives and sources are commonly used for Blazor apps. Add addi * Specify `self` to indicate that the app's origin, including the scheme and port number, is a valid source. * In a client-side Blazor app: * Specify [`wasm-unsafe-eval`](https://developer.mozilla.org/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_webassembly_execution) to permit the client-side Blazor Mono runtime to function. - * Specify any additional hashes to permit your required *non-framework scripts* to load. For example, specify [`unsafe-hashes`](https://developer.mozilla.org/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src#unsafe_hashes) with a hash of `sha256-qnHnQs7NjQNHHNYv/I9cW+I62HzDJjbnyS/OFzqlix0=` to permit the inline JavaScript for the navigation toggler in the `NavMenu` component. + * Specify any additional hashes to permit your required *non-framework scripts* to load with [`unsafe-hashes`](https://developer.mozilla.org/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src#unsafe_hashes) and script hashes to permit the inline JavaScript to load. * In a server-side Blazor app, specify hashes to permit required scripts to load. * [`style-src`](https://developer.mozilla.org/docs/Web/HTTP/Headers/Content-Security-Policy/style-src): Indicates valid sources for stylesheets. * Specify `self` to indicate that the app's origin, including the scheme and port number, is a valid source. @@ -191,7 +191,25 @@ For more information, see [CSP: frame-ancestors (MDN documentation)](https://dev The following example is a starting point for further development. At the top of [`` content](xref:blazor/project-structure#location-of-head-and-body-content), apply the directives described in the [*Policy directives*](#policy-directives) section, along with any other directives that your app specification requires. -:::moniker range=">= aspnetcore-8.0" +:::moniker range=">= aspnetcore-11.0" + +For Blazor Web Apps or Blazor Server apps: + +```html + +``` + +Blazor Web Apps have an `ImportMap` component in `` content that renders an inline import map `