Should you’re enthusiastic about Scorching Reload like me AND you additionally need an “A” grade from SecurityHeaders.com (actually, go do this now) then you’ll study in a short time about Content material-Safety-Coverage headers. It’s good to spend a while studying and you might find yourself with a considerably refined listing of allowed issues, scripts, stylesheets, and many others.
In DasBlog Core (the cross platform weblog engine that runs this weblog) Mark Downie makes these configurable and makes use of the NWebSpec ASP.NET Middleware library so as to add the wanted headers.
if (SecurityStyleSources != null && SecurityScriptSources != null && DefaultSources != null)
app.UseCsp(choices => choices
.DefaultSources(s => s.Self()
.StyleSources(s => s.Self()
.ScriptSources(s => s.Self()
Every of these variables comes out of a config file. Sure, it could be extra safety in the event that they got here out of a vault or have been even exhausting coded.
DasBlog is a pretty big and funky app and we observed instantly upon Mark upgrading it to .NET 6 that we have been unable to make use of Scorching Reload (through dotnet watch or from VS 2022). We are able to complain about it, or we will study the way it works and why it is not working for us!
Bear in mind: Nothing in your laptop is hidden from you.
Okay, this is sensible as we all know not solely does HotReload help C# (code behinds) but in addition Markup through Razor Pages and altering CSS! It could positively want to speak “again house” to the runner which is both “dotnet watch” or VS2022.
If I alter the ASPNETCORE_ENVIRONMENT to “Manufacturing” (both through launch.json, launchsettings, or an setting variable like this, I can see that additional HotReload helper script is not there:
C:githubwshotreloadtest>dotnet run --environment="Manufacturing"
data: Microsoft.Internet hosting.Lifetime
Now listening on: https://localhost:7216
data: Microsoft.Internet hosting.Lifetime
Now listening on: http://localhost:5216
Bear in mind: You by no means wish to use dotnet run in manufacturing! It is an SDK constructing command! You will wish to use dotnet exec your.dll, dotnet your.dll, or better of all, in .NET 6 simply name the EXE immediately! .binDebugnet6.0wshotreloadtest.exe in my instance. Why? dotnet run will all the time assume it is in Improvement (you actually inform it to revive, construct, and exec in a single run command) should you run it. You will be aware that operating the precise EXE is all the time WAY sooner as effectively! Do not ship your .NET SDK to your webserver and do not recompile the entire thing on startup in manufacturing!
We are able to see that that aspnnetcore-browser-refresh.js is the consumer facet of Improvement-time HotReload. Taking a look at our browser console we see :
Refused to hook up with 'wss://localhost:62486/'
as a result of it violates the next Content material Safety Coverage
directive: "default-src 'self'".
Be aware that 'connect-src' was not explicitly set,
so 'default-src' is used as a fallback.
That is rather a lot to consider. I began out my ASP.NET Internet App’s center ware saying it was OK to speak “again to myself” however nowhere else.
app.UseCsp(choices => choices.DefaultSources(s => s.Self()));
Hm, self appears affordable, why cannot the browser join BACK to the dotnet run’ed Kestrel Internet Server? It is all localhost, proper? Nicely, particularly it is http://localhost not ws://localhost, and even wss://localhost (that additional s is for safe) so I have to explicitly permit ws: or wss: or each, however solely in Improvement.
Possibly like this (once more, I am utilizing NWebSpec, however these are simply HTTP Headers so you may actually simply add them in order for you, hardcoded.)
app.UseCsp(choices => choices.DefaultSources(s => s.Self())
.ConnectSources(s => s.CustomSources("wss://localhost:62895")));
However port numbers change, proper? Let’s do exactly wss:, solely in Improvement. Now, if I am utilizing each CSPs and WebSockets (ws:, wss:) in Manufacturing, I am going to have to be intentional about this.
What is the ethical?
Should you begin utilizing CSP Headers to tighten issues up, be aware and conscious of the headers you want for conveniences like Scorching Reload in Improvement versus no matter issues you might want in Manufacturing.
Hope this helps prevent a while!
Sponsor: At Rocket Mortgage® the work you do round right here will likely be 100% impactful however received’t take all of your free time, supplying you with the proper work-life stability. Or as we name it, tech/life stability! Be taught extra.
Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, advisor, father, diabetic, and Microsoft worker. He’s a failed stand-up comedian, a cornrower, and a ebook writer.