Skip to content

Refused to load _framework/aspnetcore-browser-refresh.js due to CSP #33068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Tracked by #45213
fingers10 opened this issue May 27, 2021 · 15 comments
Closed
Tracked by #45213

Refused to load _framework/aspnetcore-browser-refresh.js due to CSP #33068

fingers10 opened this issue May 27, 2021 · 15 comments
Labels
area-commandlinetools Includes: Command line tools, dotnet-dev-certs, dotnet-user-jwts, and OpenAPI bug This issue describes a behavior which is not expected - a bug. feature-dotnetwatch This issue is related to the dotnet-watch command-line tool (now external) feature-hot-reload This issue is related to the Hot Reload feaature ✔️ Resolution: Duplicate Resolved as a duplicate of another issue Pillar: Technical Debt Status: Resolved
Milestone
.NET 9 Planning

Comments

@fingers10
Copy link

I'm working on .net 5 blazor wasm project. I recently updated my Visual Studio 2019 to version 16.10.0. All of a sudden I started getting an error message in my browser (Google Chrome) console as shown below:

Refused to load the script
'https://localhost:44340/_framework/aspnetcore-browser-refresh.js'
because it violates the following Content Security Policy directive:
"script-src 'sha256-fa5rxHhZ799izGRP38+h4ud5QXNT0SFaFlh4eqDumBI='".
Note that 'script-src-elem' was not explicitly set, so 'script-src' is
used as a fallback.

I don't have _framework/aspnetcore-browser-refresh.js added in my index.html. Here is the scripts and styles declaration in my index.html

styles declared inside <head> in index.html:

<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
    <title>App</title>
    <base href="/" />
    <link href="css/site.css" rel="stylesheet" />
    <link href="Web.styles.css" rel="stylesheet">
    <link href="_content/BlazorDateRangePicker/daterangepicker.min.css" rel="stylesheet" />
    <link href="manifest.json" rel="manifest" />
    <link rel="apple-touch-icon" sizes="512x512" href="icon-512.png" />
</head>

scripts in index.html:

<script src="_content/Microsoft.AspNetCore.Components.WebAssembly.Authentication/AuthenticationService.js"></script>
<script src="_framework/blazor.webassembly.js"></script>
<script src="js/Chart.js"></script>
<script src="js/print.js"></script>
<script src="js/pdf.js"></script>
<script src="_content/BlazorDateRangePicker/clickAndPositionHandler.js"></script>
<script src="js/blazorInterop.js"></script>
<script>navigator.serviceWorker.register('service-worker.js');</script>

But when I launch the app via visual studio, from the browser I can see that _framework/aspnetcore-browser-refresh.js gets appended to scripts section in my index.html. Here is the screen print.

index.html source

This is anything related to my configuration error? or I need to setup CSP in my index.html? Please assist.

Further technical details

  • ASP.NET Core version - 5.0.6
  • The IDE (VS / VS Code/ VS4Mac) you're running on, and its version - VS 16.0.0
@javiercn javiercn added area-blazor Includes: Blazor, Razor Components feature-blazor-wasm This issue is related to and / or impacts Blazor WebAssembly feature-blazor-aot-compilation This issue is related to AoT compilation of Blazor WebAssembly apps labels May 27, 2021
@pranavkm pranavkm added area-commandlinetools Includes: Command line tools, dotnet-dev-certs, dotnet-user-jwts, and OpenAPI and removed area-blazor Includes: Blazor, Razor Components feature-blazor-wasm This issue is related to and / or impacts Blazor WebAssembly feature-blazor-aot-compilation This issue is related to AoT compilation of Blazor WebAssembly apps labels May 27, 2021
@mkArtakMSFT mkArtakMSFT added this to the Backlog milestone May 27, 2021
@ghost
Copy link

ghost commented May 27, 2021

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

@mkArtakMSFT mkArtakMSFT mentioned this issue Jun 10, 2021
Closed
@pranavkm pranavkm removed their assignment Aug 23, 2021
@mkArtakMSFT
Copy link
Member

@pranavkm is this something that you've been looking at?

@donhuvy
Copy link

donhuvy commented Sep 20, 2021

Some one said my error related to this issue: https://stackoverflow.com/a/69252946/3728901

@TanayParikh TanayParikh added the area-blazor Includes: Blazor, Razor Components label Oct 5, 2021
@TanayParikh TanayParikh mentioned this issue Oct 5, 2021
Closed
@TanayParikh
Copy link
Contributor

Related to: #34428

@pranavkm is the _framework/aspnetcore-browser-refresh.js script constant or does it dynamically change based on the hot reload? If it's constant, we can just update the documentation to include the script hash as part of the CSP, like we currently do for the WASM Module script injected into the page.

@TanayParikh TanayParikh changed the title Refused to load _framework/aspnetcore-browser-refresh.js after upgrading visual studio to 16.10.0 Refused to load _framework/aspnetcore-browser-refresh.js due to CSP Oct 5, 2021
@pranavkm
Copy link
Contributor

pranavkm commented Oct 5, 2021

The script has a couple of dynamic components which makes this tricky. I think one of the ideas was to
a) Have a way to opt out of the script being auto-injected
b) Add an environment variable that includes metadata so a user can reasonably configure their CSP.

Browserlink in VS which is now injected by default also has this issue, so we kinda have to make sure this scales (or figure out how to roll everything into a single import).

@mkArtakMSFT mkArtakMSFT added the feature-dotnetwatch This issue is related to the dotnet-watch command-line tool (now external) label Oct 14, 2021
@pranavkm pranavkm mentioned this issue Oct 19, 2021
Closed
@gbjbaanb
Copy link

As mentioned previously (twice!) here's my debug info of what's going on. Looks like the port used for the refresh is dynamically set and thus cannot easily be placed in a CSP rule at development time. There's no way to set the port, or to use a common one for all VS installations. A solution might be to use a different endpoint on the existing site for refresh functionality rather than try to connect to a different port.

#31320 (comment)

@TanayParikh TanayParikh mentioned this issue Nov 1, 2021
Closed
@pranavkm pranavkm modified the milestones: Backlog, .NET 7 Planning Nov 4, 2021
@mkArtakMSFT mkArtakMSFT added triaged Priority:1 Work that is critical for the release, but we could probably ship without labels Nov 4, 2021
@pranavkm pranavkm removed the Priority:1 Work that is critical for the release, but we could probably ship without label Nov 4, 2021
@ASP-WAF
Copy link

ASP-WAF commented Nov 7, 2021

to allow this while developing alter the CSP header on the response of the page. My Nuget Package walter.web.firewall will do this for you

@flavio2201
Copy link

I faced the same issue and added: "default-src 'self' 'unsafe-eval'". It is a temporary fix though. I wish we had a proper fix to avoid the 'unsafe-eval' line.

@mkArtakMSFT mkArtakMSFT added triaged bug This issue describes a behavior which is not expected - a bug. and removed Docs This issue tracks updating documentation labels Oct 27, 2022
@aKzenT
Copy link

aKzenT commented Aug 30, 2023

There is a way to disable the injection of the aspnetcore-browser-refresh script using configuration settings. Basically the script is injected by a middleware which is injected using hosting startup assemblies. You can disable the specific hosting startup assembly using this code:

builder.UseSetting(WebHostDefaults.HostingStartupExcludeAssembliesKey, "Microsoft.AspNetCore.Watch.BrowserRefresh");

Or using an environment variable ASPNETCORE_HOSTINGSTARTUPEXCLUDEASSEMBLIES with the same value.

@aKzenT aKzenT mentioned this issue Aug 30, 2023
Open
@ghost
Copy link

ghost commented Oct 6, 2023

Thanks for contacting us.

We're moving this issue to the .NET 9 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

@Myster
Copy link

Myster commented Oct 30, 2023

We use 'strict-dynamic' with nonce attributes on all our scripts which precludes the use of 'self'.
Perhaps if we could implement some interface which would return the nonce so it can be applied to the preload script tag (I have no idea if that's even remotely feasible depending on how the script is generated and injected.)
And given this is just for dev environment... probably very low priority.

Perhaps nonces need baking into the MVC framework :-)

@mkArtakMSFT mkArtakMSFT added Pillar: Technical Debt and removed area-blazor Includes: Blazor, Razor Components labels Nov 5, 2023
@mkArtakMSFT mkArtakMSFT added the feature-hot-reload This issue is related to the Hot Reload feaature label Dec 14, 2023
@ghost
Copy link

ghost commented Dec 14, 2023

Thanks for contacting us.

We're moving this issue to the .NET 9 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

@kathleenwest
Copy link

I am working on the Microsoft Learn tutorials, and this is still an issue https://learn.microsoft.com/en-us/training/modules/dotnet-microservices/5-exercise-create-docker-compose-file

Refused to load the script 'http://localhost:32000/_framework/blazor.web.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

@mkArtakMSFT mkArtakMSFT added the Priority:1 Work that is critical for the release, but we could probably ship without label Jan 12, 2024
@mkArtakMSFT mkArtakMSFT removed the Priority:1 Work that is critical for the release, but we could probably ship without label Jan 12, 2024
@mkArtakMSFT mkArtakMSFT mentioned this issue Jan 30, 2024
Open
2 tasks
@mkArtakMSFT
Copy link
Member

Closing as this will be handled as part of #45213

@mkArtakMSFT mkArtakMSFT closed this as not planned Won't fix, can't repro, duplicate, stale Jan 30, 2024
@mkArtakMSFT mkArtakMSFT added the ✔️ Resolution: Duplicate Resolved as a duplicate of another issue label Jan 30, 2024
@ghost ghost added the Status: Resolved label Jan 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area-commandlinetools Includes: Command line tools, dotnet-dev-certs, dotnet-user-jwts, and OpenAPI bug This issue describes a behavior which is not expected - a bug. feature-dotnetwatch This issue is related to the dotnet-watch command-line tool (now external) feature-hot-reload This issue is related to the Hot Reload feaature ✔️ Resolution: Duplicate Resolved as a duplicate of another issue Pillar: Technical Debt Status: Resolved
Projects
None yet
Milestone
.NET 9 Planning
Development

No branches or pull requests
14 participants
@pranavkm @Myster @donhuvy @aKzenT @gbjbaanb @javiercn @MackinnonBuck @TanayParikh @flavio2201 @kathleenwest @mkArtakMSFT @fingers10 @ASP-WAF and others