Content Security Policy

Lagoon generates the HTTP Content-Security-Policy header from the application's public URL and the Lagoon:CSP section of the appsettings.json file.

appsettings.json configuration

{
  "Lagoon": {
    "CSP": {
      "enabled": true,
      "custom": "",
      "img-src-add": "https:",
      "img-src-remove": "blob:",
      "connect-src": "'none'",
      "upgrade-insecure-requests": false
    }
  }
}

Option	Description
enabled	Enables or disables CSP. The default value is true.
custom	Sets a fully customized CSP value. When this key is set, the per-source settings are ignored.
<source>-add	Adds a source to an existing directive, for example img-src-add.
<source>-remove	Removes a source from an existing directive, for example img-src-remove.
<source>	Replaces the entire directive, for example connect-src.
upgrade-insecure-requests	Enables or disables the addition of upgrade-insecure-requests. By default, Lagoon adds it when Lagoon:PublicUrl starts with https://.

warning

A full replacement like connect-src: "'none'" can block network features of the application. Prefer the -add and -remove suffixes when adapting only an existing rule.

Default CSP rules

For an application at the root /, Lagoon generates the following directives in .NET 8.

base-uri 'self';
default-src 'self';
img-src 'self' data: blob:;
frame-src 'self' blob:;
object-src 'none';
script-src 'self' 'wasm-unsafe-eval';
style-src 'self' 'unsafe-inline';
upgrade-insecure-requests;

In the Development environment, Lagoon adds the necessary sources for local tools:

default-src ... http://localhost:*/ ws://localhost:*/;

Application published in a subdirectory

When Lagoon:PublicUrl points to a subdirectory, Lagoon replaces 'self' with the public URL restricted to the subdirectory.

base-uri https://localhost:5011/draft/;
default-src https://localhost:5011/draft/ wss://localhost:5011/draft/;
img-src https://localhost:5011/draft/ data: blob:;
frame-src https://localhost:5011/draft/ blob:;
object-src 'none';
script-src https://localhost:5011/draft/ 'wasm-unsafe-eval';
style-src https://localhost:5011/draft/ 'unsafe-inline';
upgrade-insecure-requests;

In the Development environment, Lagoon also adds the necessary local sources for debugging and development resources.

default-src ... http://localhost:*/ ws://localhost:*/;
script-src ... https://localhost:5011/;

Customizing a directive

The configuration suffixes allow you to modify directives without rewriting the entire CSP.

{
  "Lagoon": {
    "CSP": {
      "img-src-add": "https:",
      "img-src-remove": "blob:",
      "connect-src-add": "https://api.example.com"
    }
  }
}

upgrade-insecure-requests

upgrade-insecure-requests tells the browser to prioritize encrypted and authenticated responses. Lagoon adds this directive by default when the public URL starts with https://.

For an application intentionally published over HTTP, set explicitly:

{
  "Lagoon": {
    "CSP": {
      "upgrade-insecure-requests": false
    }
  }
}

info

The script-src rule depends on the .NET version used by Blazor WebAssembly. In .NET 8, Lagoon uses wasm-unsafe-eval.