Content security policy headers (CSP) #6752

sachatrauwaen · 2025-10-03T14:52:36Z

Summary

Create a possibility to generate Content security policy (csp) headers .

Content Security Policy is a crucial security standard that helps protect your web applications from various types of attacks, including Cross-Site Scripting (XSS), clickjacking, and other code injection attacks. It works by allowing you to specify which resources (scripts, styles, images, etc.) your browser should be allowed to load.
more info about Content security policy

Description of solution

The intend is to manage CSP for WebForms and MVC pipeline.

Webforms can not be very struct in the policy that can be used. Here script-src 'unsafe-inline' and 'unsafe-eval' will be automatically added to csp. It is not added in the settings because it's specific for webforms.
In the future MVC pipeline can be very strict. Here no js evaluation will be used and all inline javascript will be marked with a nonce.

This is the default csp for the setting

default-src 'self'; script-src 'self' 'report-sample'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; frame-src 'self'; connect-src 'self';

It dous not accept external resources.
It accept inline css : actually used by the default page of dnn and generated by ckeditor with default configuration. But it is not recomended. ckeditor can be configurated to not use inline css.
It accept image src starting with data: bacause it is used by default dnn page. But it is not recomended.

3 http headers will be managed : Content-Security-Policy, Content-Security-Policy-Report-Only and Reporting-Endpoints

Persona bar - Security settings

Implementation

It commes in a new project for csp management and a test project.

The IContentSecurityPolicy service that can be used with DI had all the stuff for skin and module developers to contribute to the policy.

For webforms skin developers actually the way to contribute is

<script runat="server">
    protected void Page_Init()
    {
        var defaultPage = (DotNetNuke.Framework.DefaultPage)this.Page;
        defaultPage.AddCsp("script-src https://ajax.aspnetcdn.com");
    }
</script>

Details of DotNetNuke.ContentSecurityPolicy library

The DotNetNuke.ContentSecurityPolicy library provides a fluent API for building and emitting Content Security Policy (CSP) headers in DNN. The IContentSecurityPolicy interface is the main entry point to compose directives, manage sources, configure reporting, and generate final header strings.

Interface: `IContentSecurityPolicy`

Namespace: DotNetNuke.ContentSecurityPolicy

Properties

Nonce: Cryptographically secure nonce value to use with inline script/style tags.
DefaultSource: SourceCspContributor for default-src.
ScriptSource: SourceCspContributor for script-src.
StyleSource: SourceCspContributor for style-src.
ImgSource: SourceCspContributor for img-src.
ConnectSource: SourceCspContributor for connect-src.
FontSource: SourceCspContributor for font-src.
ObjectSource: SourceCspContributor for object-src.
MediaSource: SourceCspContributor for media-src.
FrameSource: SourceCspContributor for frame-src.
FrameAncestors: SourceCspContributor for frame-ancestors.
FormAction: SourceCspContributor for form-action.
BaseUriSource: SourceCspContributor for base-uri.

Methods

RemoveScriptSources(CspSourceType cspSourceType): Remove script sources of the specified type (e.g., Inline, Self, Nonce).
AddPluginTypes(string value): Add values for plugin-types (e.g., application/pdf).
AddSandboxDirective(string value): Add sandbox options (e.g., allow-scripts allow-same-origin).
AddFormAction(CspSourceType sourceType, string value): Add a form-action source.
AddFrameAncestors(CspSourceType sourceType, string value): Add a frame-ancestors source.
AddReportEndpoint(string name, string value): Add a named reporting endpoint.
AddReportTo(string value): Add a report-to group name to the policy.
AddHeaders(string cspHeader): Parse and merge a CSP header string; returns the same IContentSecurityPolicy for chaining.
GeneratePolicy(): Build the Content-Security-Policy header value.
GenerateReportingEndpoints(): Build the reporting header value(s).
UpgradeInsecureRequests(): Add the upgrade-insecure-requests directive.

Working with sources

Directive properties expose a SourceCspContributor, which supports adding/removing sources such as:

AddSelf() → 'self'
AddNone() → 'none'
AddInline() → 'unsafe-inline'
AddEval() → 'unsafe-eval'
AddStrictDynamic() → 'strict-dynamic'
AddNonce(string) → 'nonce-<value>'
AddHash(string) → 'sha256-...', 'sha384-...', 'sha512-...'
AddHost(string) → example.com, https://cdn.example.com
AddScheme(string) → https:, data:, blob:
RemoveSources(CspSourceType) to remove by type

See: CspSourceType.cs, CspSource.cs, SourceCspContributor.cs.

Usage examples

Configure a baseline policy with a nonce

using DotNetNuke.ContentSecurityPolicy;

public class CspExample
{
    private readonly IContentSecurityPolicy _csp;

    public CspExample(IContentSecurityPolicy csp)
    {
        _csp = csp;
    }

    public void Configure()
    {
        // Default baseline
        _csp.DefaultSource.AddSelf();
        _csp.ScriptSource.AddSelf().AddNonce(_csp.Nonce);
        _csp.StyleSource.AddSelf();
        _csp.ImgSource.AddSelf().AddScheme("data:");

        // Lock down frames and forms
        _csp.FrameAncestors.AddNone();
        _csp.FormAction.AddSelf();

        // Reporting
        _csp.AddReportEndpoint("csp-endpoint", "/api/csp/report");
        _csp.AddReportTo("csp-endpoint");

        // Optionally upgrade insecure requests
        _csp.UpgradeInsecureRequests();

        // Generate header values
        var cspHeader = _csp.GeneratePolicy();
        var reportingHeader = _csp.GenerateReportingEndpoints();

    }
}

Parse and merge an existing CSP header

_csp.AddHeaders("default-src 'self'; img-src 'self' data:")
    .ScriptSource.AddNonce(_csp.Nonce);

var headerValue = _csp.GeneratePolicy();

Remove an unsafe source

_csp.RemoveScriptSources(CspSourceType.Inline);

Notes

Nonce: use Nonce in your inline tags: <script nonce="{policy.Nonce}">.
Reporting: ensure your endpoint exists to accept violation reports.
Parsing: AddHeaders is useful to import settings from configuration and extend them programmatically.
This is not only about js and css but also about images, iframes and more (parts of the content).

Update 22 october 2025

There are 2 point of views :

The site settings are there for the site admin to enforce some policies. In this case, the policy need to include all requirements (from skins, modules, skin object, content, ...) and all pages (not only dnn pages but also edit urls need to be included in this policies to get them work properly). Actually this can already done with a the web.config setting. Or you need different policies for different use cases/ user profils (Anonymous, loged in, page admin, module editor, host, ...).
(The point of view of this PR) The site settings are there for defining a starting policy where skins, modules, ... can add dynamically there policy. So the policy will be adjusted automatically to make the site work.

What is sure is that modules and skins will paticipate in the ability to make the policies strict.
Knowing witch policies are required by a skin or modules is key even what kind of content is permited, if you want to be strict.

Know that browsers include also a way to report csp policy violations to the browser console and to a endpoint.

Fixes #6720

…ault.aspx modifications

mitchelsellers · 2025-10-03T15:48:25Z

With this, how exactly does the configured process in the persona bar work with the fact that anyone could manipulate this via other methods in the skin, module, etc?

Is the portal done first and then changes applied?

How is the users input validated in the personarbar validated? is it serialized to an object with detailed validation errors?

sachatrauwaen · 2025-10-03T15:57:55Z

With this, how exactly does the configured process in the persona bar work with the fact that anyone could manipulate this via other methods in the skin, module, etc?
Is the portal done first and then changes applied?

Yes, the portal settings are applied first in the OnInit of the page (default.aspx).
Then skin and modules can add there policy. Normally skins and modules will only add addional policy.
And finally in the OnPreRender of the page the full policy string is generated and added to the http response header.

How is the users input validated in the personarbar validated? is it serialized to an object with detailed validation errors?

The library containt a policy parser. But actully no validation error is showed to the user that enter the settings.
I will look to add this.

donker · 2025-11-07T14:58:27Z

@sachatrauwaen: can you add a switch for the admin that governs whether a module can enlarge the CSP scope or not? That way the admin decides what is allowed and knows what is going to happen.

sachatrauwaen · 2025-11-12T10:11:21Z

@sachatrauwaen: can you add a switch for the admin that governs whether a module can enlarge the CSP scope or not? That way the admin decides what is allowed and knows what is going to happen.

In reality there 2 ways to add policies to CSP : 1) site settings 2) api (used by the core, modules, skins, editor providers and potentialy all other extensions).

The site settings where actually for define the default strict policy, policy for content (images, iframe, css) and policy for modules that not automatically add there policy.

When we want to add a "switch for the admin that governs whether a module can enlarge the CSP scope or not" it is for all policies added by api not only modules. So we add only the policy from the site settings.

# Conflicts: # DNN Platform/Website/Default.aspx.cs

…rge the CSP scope or not

sachatrauwaen · 2025-11-13T14:51:56Z

New Sitting is added

valadas · 2025-11-15T04:54:17Z

DNN Platform/Website/Default.aspx.cs

+        public void AddCsp(string policy)
+        {
+            this.ContentSecurityPolicy.AddHeader(policy);
+        }


Does this method need to be public?

valadas · 2025-11-15T07:33:35Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/SourceCspContributor.cs

+        /// <summary>
+        /// Ajoute une source 'self' qui autorise les ressources de la même origine.
+        /// </summary>
+        /// <returns>L'instance courante pour chaîner les méthodes.</returns>


This documentation appears to be in french, we usually do it in english for a wider audience of developers

Same for multiple others in this file

valadas · 2025-11-15T07:56:45Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/ContentSecurityPolicy.cs

+                if (this.nonce == null)
+                {
+                    var nonceBytes = new byte[32];
+                    var generator = System.Security.Cryptography.RandomNumberGenerator.Create();


Should we create a single instance of the RandomNumberGenerator at the class level so we dont do a new one each time a resource is added. This service is registered as scoped so that way we could reuse that existing instance if many resources get added in the same request.

Should we create a single instance of the RandomNumberGenerator at the class level so we dont do a new one each time a resource is added.

Because it is scoped, a new one created for each request only (not for each resource added) and if Nonce is used.

And because it implements IDisposable (as Mich say) if it will be create at class level, it will be never disposed.

valadas · 2025-11-15T08:21:29Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/CspDirectiveType.cs

+    public enum CspDirectiveType
+    {
+        /// <summary>
+        /// Directive qui définit la politique par défaut pour les types de ressources non spécifiés.


This class also has most of its documentation in french

valadas · 2025-11-15T08:23:07Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/CspParsingExample.cs

+    /// <summary>
+    /// Example class demonstrating how to parse Content Security Policy headers.
+    /// </summary>
+    public static class CspParsingExample


Can we move usage examples to the tests project maybe, or maybe tests are good enough examples?

i remove the examples

valadas · 2025-11-15T08:23:47Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/CspPolicyExample.cs

+    /// <summary>
+    /// Démontre l'utilisation de la Content Security Policy en configurant différentes directives.
+    /// </summary>
+    public class CspPolicyExample


Same here, maybe tests could replace examples here...

mitchelsellers · 2025-11-15T16:11:55Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/ContentSecurityPolicy.cs

+                if (this.nonce == null)
+                {
+                    var nonceBytes = new byte[32];
+                    var generator = System.Security.Cryptography.RandomNumberGenerator.Create();


Additionally, RandomNumberGenerator is a class that implements IDisposable, it should at minimum be within a using to prevent resource leaking

i add using

… into dev-csp

valadas · 2025-11-15T21:39:08Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/CspSource.cs

+            }
+
+            // Basic domain validation
+            var domainRegex = new Regex(@"^(https?://)?([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}(:\d+)?(/.*)?$");


I am no expert in CSP but I think this regex might be wrong and maybe not optimal for performance too. I believe HostSource should support extensionless domains like localhost and wildcards like *.somecdn.com or simply *, domains with long TLDs like something.technology, IP and port, IPV6, etc. So it that should be a supported scenario I would love that we have some tests for a list of those that should be supported.

Maybe we could allow some of CSP specific scenarios like "*" and similar, then run Uri.TryCreate(value) to validate the more normal ones and if it still does not pass, we can do IPAddress.TryParse(value)?

Additionally, this is in a hot path for execution, compiling this regex at minimum should be done for performance, and limit processing time as well

I change it.
But I was thinking that all the regexp validation is maybe overkill. And because it is evaluated on each request , its maybe better to remove it.
What do you think ?

I think given it is executed on EVERY request, I'd be very inclined to NOT do this validation and test that it was correct, or find a way to validate at a different stage.

i remove the syntax checks from all request. They only be done on site settings save.

valadas · 2025-11-15T21:44:37Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/DocumentCspContributor.cs

+        /// </summary>
+        private void ValidatePluginTypes(string value)
+        {
+            string[] validPluginTypes = { "application/pdf", "image/svg+xml" };


Is this correct to hardcode only those mime-types, I am not sure but should this allow other types like word/excel, etc.?

valadas · 2025-11-15T21:53:46Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/IContentSecurityPolicy.cs

+        IContentSecurityPolicy AddHeader(string cspHeader);
+
+        /// <summary>
+        /// Ajoute une directive de rapport à la politique.


This file also has some french documentation

DNN Platform/DotNetNuke.ContentSecurityPolicy/ReportingCspContributor.cs

valadas · 2025-11-15T21:55:39Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/ReportingCspContributor.cs

+            }
+
+            // URL validation regex
+            var urlRegex = new Regex(@"^(https?://)?([a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*)?(:\d+)?(/.*)?$");


Maybe we could use Uri.TryParse here too to validate without a complex regex?

Additionally, this is a validation that is shared across multiple sections, it would be good to standardize this validaton if we can should it need to change.

DNN Platform/DotNetNuke.ContentSecurityPolicy/ReportingEndpointContributor.cs

valadas · 2025-11-15T21:56:50Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/ReportingEndpointContributor.cs

+            }
+
+            // URL validation regex
+            var urlRegex = new Regex(@"^(https?://)([a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*)?(:\d+)?(/.*)?$");


Maybe we could use URI.TryParse also?

valadas · 2025-11-15T22:03:25Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/dnn.json

@@ -0,0 +1,16 @@
+{


What is the purpose of this file?

valadas · 2025-11-15T22:10:03Z

DNN Platform/Website/Default.aspx.cs

            // set global page settings
            this.InitializePage();

+            if (!this.PortalSettings.CspHeaderFixed &&


The code for when CspHeaderFixed is true is pretty far from another block of code that handles when it is false. In am not sure if it needs to be that way because there is an important order or operations, but if not, can we possibly bring those together in a private method and improve the readability of this file?

mitchelsellers · 2025-11-16T05:15:37Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/ContentSecurityPolicy.cs

+        private string nonce;
+
+        /// <summary>Initializes a new instance of the <see cref="ContentSecurityPolicy"/> class.</summary>
+        public ContentSecurityPolicy()


Given that we don't need to do anything special here with the constructor, this should be omitted

mitchelsellers · 2025-11-16T05:22:24Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/ContentSecurityPolicyParser.cs

+        /// </summary>
+        private static bool IsScheme(string source)
+        {
+            string[] knownSchemes = { "http:", "https:", "data:", "blob:", "filesystem:", "wss:", "ws:" };


For consistency in naming this should be var knownSchemes

mitchelsellers · 2025-11-16T05:31:53Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/CspSource.cs

+            }
+
+            // Basic domain validation
+            var domainRegex = new Regex(@"^(https?://)?([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}(:\d+)?(/.*)?$");


Additionally, this is in a hot path for execution, compiling this regex at minimum should be done for performance, and limit processing time as well

mitchelsellers · 2025-11-16T05:34:31Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/CspSource.cs

+        /// </summary>
+        private string ValidateSchemeSource(string value)
+        {
+            string[] validSchemes = { "http:", "https:", "data:", "blob:", "filesystem:", "wss:", "ws:" };


For coding consistency this should be var

Similar comment for other items in this file

mitchelsellers · 2025-11-16T05:38:32Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/DocumentCspContributor.cs

+        /// Sets the directive value with validation.
+        /// </summary>
+        /// <param name="value">The value to set for the directive.</param>
+        public void SetDirectiveValue(string value)


Why was a separate method implement for this, rather than just doing this as a setter?

mitchelsellers · 2025-11-16T05:41:22Z

DNN Platform/DotNetNuke.ContentSecurityPolicy/ReportingCspContributor.cs

+            }
+
+            // URL validation regex
+            var urlRegex = new Regex(@"^(https?://)?([a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*)?(:\d+)?(/.*)?$");


Additionally, this is a validation that is shared across multiple sections, it would be good to standardize this validaton if we can should it need to change.

mitchelsellers · 2025-11-16T05:44:15Z

DNN Platform/Library/Entities/Portals/PortalSettings.cs

+            /// <summary>Content Security Header is not added.</summary>
+            Off = 0,
+
+            /// <summary>Content Security Header is not added in Report Only.</summary>


I believe this summary is incorrect and it should be "Content Security Header is added in Report Only mode."

enhance mine type validation replace french doc with english replace regexp for url validation with Uri.TryCreate cleanup

…age anymore

syntax check is only done when saving site settings

sachatrauwaen and others added 4 commits October 3, 2025 16:19

Add content security policy (personabar settings, new library and def…

f6e90c1

…ault.aspx modifications

Unit tests for CSP library

8d7b31c

add documentation

8904876

Merge branch 'develop' into dev-csp

d855d0b

sachatrauwaen marked this pull request as ready for review October 3, 2025 15:48

dnnsoftware deleted a comment from mitchelsellers Oct 3, 2025

sachatrauwaen added 2 commits October 4, 2025 22:07

add validation to csp settings ui

9ba68bf

try catch to avoid page error if error in header

30f4ff0

sachatrauwaen added 2 commits November 12, 2025 20:54

Merge branch 'development' into dev-csp

aa5fa53

# Conflicts: # DNN Platform/Website/Default.aspx.cs

add Csp Header Fixed site setting : governs whether a module can enla…

8bad493

…rge the CSP scope or not

donker added this to Issue Triage and MVC pipeline Nov 14, 2025

donker added this to the 10.2.0 milestone Nov 14, 2025

donker added Type: Feature Noteworthy labels Nov 14, 2025

valadas requested changes Nov 15, 2025

View reviewed changes

mitchelsellers reviewed Nov 15, 2025

View reviewed changes

sachatrauwaen and others added 6 commits November 15, 2025 17:51

add using for object dispose

13003e0

translate docs to english and remove examples

d471f49

remove AddCsp

4caea19

Merge branch 'develop' into dev-csp

3117831

fix blank line

fd9026b

Merge branch 'dev-csp' of https://github.com/sachatrauwaen/Dnn.Platform…

c1fa548

… into dev-csp

valadas requested changes Nov 15, 2025

View reviewed changes

mitchelsellers reviewed Nov 16, 2025

View reviewed changes

sachatrauwaen added 6 commits November 16, 2025 19:27

enhance source regexp and precompile regexp

defb1f5

enhance mine type validation replace french doc with english replace regexp for url validation with Uri.TryCreate cleanup

fix doc

1f8a2cb

remove data: from image source because dnn home page dont use data im…

3b1cb2e

…age anymore

make csp stuff more readable

20ec007

cleanup

3df3de7

remove syntax check from all request

709ce0f

syntax check is only done when saving site settings

Uh oh!

Content security policy headers (CSP) #6752

Are you sure you want to change the base?

Content security policy headers (CSP) #6752

Conversation

sachatrauwaen commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Description of solution

Persona bar - Security settings

Implementation

Details of DotNetNuke.ContentSecurityPolicy library

Interface: IContentSecurityPolicy

Properties

Methods

Working with sources

Usage examples

Configure a baseline policy with a nonce

Parse and merge an existing CSP header

Remove an unsafe source

Notes

Update 22 october 2025

Uh oh!

mitchelsellers commented Oct 3, 2025

Uh oh!

sachatrauwaen commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

donker commented Nov 7, 2025

Uh oh!

sachatrauwaen commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sachatrauwaen commented Nov 13, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sachatrauwaen commented Oct 3, 2025 •

edited

Loading

Interface: `IContentSecurityPolicy`

sachatrauwaen commented Oct 3, 2025 •

edited

Loading

sachatrauwaen commented Nov 12, 2025 •

edited

Loading