Refused to load `_framework/aspnetcore-browser-refresh.js` due to CSP #33068

fingers10 · 2021-05-27T09:38:45Z

I'm working on .net 5 blazor wasm project. I recently updated my Visual Studio 2019 to version 16.10.0. All of a sudden I started getting an error message in my browser (Google Chrome) console as shown below:

Refused to load the script
'https://localhost:44340/_framework/aspnetcore-browser-refresh.js'
because it violates the following Content Security Policy directive:
"script-src 'sha256-fa5rxHhZ799izGRP38+h4ud5QXNT0SFaFlh4eqDumBI='".
Note that 'script-src-elem' was not explicitly set, so 'script-src' is
used as a fallback.

I don't have _framework/aspnetcore-browser-refresh.js added in my index.html. Here is the scripts and styles declaration in my index.html

styles declared inside <head> in index.html:

<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
    <title>App</title>
    <base href="/" />
    <link href="css/site.css" rel="stylesheet" />
    <link href="Web.styles.css" rel="stylesheet">
    <link href="_content/BlazorDateRangePicker/daterangepicker.min.css" rel="stylesheet" />
    <link href="manifest.json" rel="manifest" />
    <link rel="apple-touch-icon" sizes="512x512" href="icon-512.png" />
</head>

scripts in index.html:

<script src="_content/Microsoft.AspNetCore.Components.WebAssembly.Authentication/AuthenticationService.js"></script>
<script src="_framework/blazor.webassembly.js"></script>
<script src="js/Chart.js"></script>
<script src="js/print.js"></script>
<script src="js/pdf.js"></script>
<script src="_content/BlazorDateRangePicker/clickAndPositionHandler.js"></script>
<script src="js/blazorInterop.js"></script>
<script>navigator.serviceWorker.register('service-worker.js');</script>

But when I launch the app via visual studio, from the browser I can see that _framework/aspnetcore-browser-refresh.js gets appended to scripts section in my index.html. Here is the screen print.

This is anything related to my configuration error? or I need to setup CSP in my index.html? Please assist.

Further technical details

ASP.NET Core version - 5.0.6
The IDE (VS / VS Code/ VS4Mac) you're running on, and its version - VS 16.0.0

The text was updated successfully, but these errors were encountered:

ghost · 2021-05-27T16:55:15Z

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

mkArtakMSFT · 2021-09-12T18:17:28Z

@pranavkm is this something that you've been looking at?

donhuvy · 2021-09-20T10:39:35Z

Some one said my error related to this issue: https://stackoverflow.com/a/69252946/3728901

TanayParikh · 2021-10-05T14:28:59Z

Related to: #34428

@pranavkm is the _framework/aspnetcore-browser-refresh.js script constant or does it dynamically change based on the hot reload? If it's constant, we can just update the documentation to include the script hash as part of the CSP, like we currently do for the WASM Module script injected into the page.

pranavkm · 2021-10-05T15:40:25Z

The script has a couple of dynamic components which makes this tricky. I think one of the ideas was to
a) Have a way to opt out of the script being auto-injected
b) Add an environment variable that includes metadata so a user can reasonably configure their CSP.

Browserlink in VS which is now injected by default also has this issue, so we kinda have to make sure this scales (or figure out how to roll everything into a single import).

gbjbaanb · 2021-10-20T14:51:15Z

As mentioned previously (twice!) here's my debug info of what's going on. Looks like the port used for the refresh is dynamically set and thus cannot easily be placed in a CSP rule at development time. There's no way to set the port, or to use a common one for all VS installations. A solution might be to use a different endpoint on the existing site for refresh functionality rather than try to connect to a different port.

#31320 (comment)

ASP-WAF · 2021-11-07T09:06:59Z

to allow this while developing alter the CSP header on the response of the page. My Nuget Package walter.web.firewall will do this for you

flavio2201 · 2022-10-04T19:49:02Z

I faced the same issue and added: "default-src 'self' 'unsafe-eval'". It is a temporary fix though. I wish we had a proper fix to avoid the 'unsafe-eval' line.

aKzenT · 2023-08-30T16:38:03Z

There is a way to disable the injection of the aspnetcore-browser-refresh script using configuration settings. Basically the script is injected by a middleware which is injected using hosting startup assemblies. You can disable the specific hosting startup assembly using this code:

builder.UseSetting(WebHostDefaults.HostingStartupExcludeAssembliesKey, "Microsoft.AspNetCore.Watch.BrowserRefresh");

Or using an environment variable ASPNETCORE_HOSTINGSTARTUPEXCLUDEASSEMBLIES with the same value.

ghost · 2023-10-06T17:41:37Z

Thanks for contacting us.

We're moving this issue to the .NET 9 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

Myster · 2023-10-30T02:09:00Z

We use 'strict-dynamic' with nonce attributes on all our scripts which precludes the use of 'self'.
Perhaps if we could implement some interface which would return the nonce so it can be applied to the preload script tag (I have no idea if that's even remotely feasible depending on how the script is generated and injected.)
And given this is just for dev environment... probably very low priority.

Perhaps nonces need baking into the MVC framework :-)

ghost · 2023-12-14T17:03:27Z

Thanks for contacting us.

We're moving this issue to the .NET 9 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

kathleenwest · 2024-01-01T21:48:50Z

I am working on the Microsoft Learn tutorials, and this is still an issue https://learn.microsoft.com/en-us/training/modules/dotnet-microservices/5-exercise-create-docker-compose-file

Refused to load the script 'http://localhost:32000/_framework/blazor.web.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

mkArtakMSFT · 2024-01-30T19:47:26Z

Closing as this will be handled as part of #45213

javiercn added area-blazor Includes: Blazor, Razor Components feature-blazor-wasm This issue is related to and / or impacts Blazor WebAssembly feature-blazor-aot-compilation This issue is related to AoT compilation of Blazor WebAssembly apps labels May 27, 2021

mkArtakMSFT assigned pranavkm May 27, 2021

mkArtakMSFT added the investigate label May 27, 2021

mkArtakMSFT added this to the Backlog milestone May 27, 2021

mkArtakMSFT mentioned this issue Jun 10, 2021

Should HotReload work with VS 2019 16.11.0 Preview 1.0 and a WebAssembly .NET 5 .NET Core Hosted project? #33430

Closed

pranavkm removed their assignment Aug 23, 2021

TanayParikh added the area-blazor Includes: Blazor, Razor Components label Oct 5, 2021

TanayParikh mentioned this issue Oct 5, 2021

CSP for Blazor #34428

Closed

TanayParikh changed the title ~~Refused to load _framework/aspnetcore-browser-refresh.js after upgrading visual studio to 16.10.0~~ Refused to load _framework/aspnetcore-browser-refresh.js due to CSP Oct 5, 2021

mkArtakMSFT added the feature-dotnetwatch This issue is related to the dotnet-watch command-line tool (now external) label Oct 14, 2021

pranavkm mentioned this issue Oct 19, 2021

Refresh Browser After Build - iFrame and Content Security Policy Error #31320

Closed

TanayParikh mentioned this issue Nov 1, 2021

Content Security Policy blocks script execution in default template. #37992

Closed

pranavkm modified the milestones: Backlog, .NET 7 Planning Nov 4, 2021

mkArtakMSFT added triaged Priority:1 Work that is critical for the release, but we could probably ship without labels Nov 4, 2021

pranavkm removed the Priority:1 Work that is critical for the release, but we could probably ship without label Nov 4, 2021

mkArtakMSFT removed the triaged label Sep 28, 2022

mkArtakMSFT added triaged bug This issue describes a behavior which is not expected - a bug. and removed Docs This issue tracks updating documentation labels Oct 27, 2022

aKzenT mentioned this issue Aug 30, 2023

Support disabling auto-injection of browser refresh JavaScript via launch profile property #44805

Open

mkArtakMSFT modified the milestones: .NET 8 Planning, .NET 9 Planning Oct 6, 2023

mkArtakMSFT removed the triaged label Oct 20, 2023

mkArtakMSFT modified the milestones: .NET 9 Planning, BlazorPlanning Nov 5, 2023

mkArtakMSFT added Pillar: Technical Debt and removed area-blazor Includes: Blazor, Razor Components labels Nov 5, 2023

mkArtakMSFT added the feature-hot-reload This issue is related to the Hot Reload feaature label Dec 14, 2023

mkArtakMSFT modified the milestones: Planning: WebUI, .NET 9 Planning Dec 14, 2023

mkArtakMSFT added the Priority:1 Work that is critical for the release, but we could probably ship without label Jan 12, 2024

mkArtakMSFT assigned MackinnonBuck Jan 12, 2024

mkArtakMSFT removed the Priority:1 Work that is critical for the release, but we could probably ship without label Jan 12, 2024

mkArtakMSFT unassigned MackinnonBuck Jan 12, 2024

mkArtakMSFT mentioned this issue Jan 30, 2024

Revisit hot reload browser refresh script injection #45213

Open

2 tasks

mkArtakMSFT closed this as not planned Won't fix, can't repro, duplicate, stale Jan 30, 2024

mkArtakMSFT added the ✔️ Resolution: Duplicate Resolved as a duplicate of another issue label Jan 30, 2024

ghost added the Status: Resolved label Jan 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refused to load `_framework/aspnetcore-browser-refresh.js` due to CSP #33068

Refused to load `_framework/aspnetcore-browser-refresh.js` due to CSP #33068

fingers10 commented May 27, 2021

ghost commented May 27, 2021

mkArtakMSFT commented Sep 12, 2021

donhuvy commented Sep 20, 2021

TanayParikh commented Oct 5, 2021

pranavkm commented Oct 5, 2021

gbjbaanb commented Oct 20, 2021

ASP-WAF commented Nov 7, 2021

flavio2201 commented Oct 4, 2022

aKzenT commented Aug 30, 2023

ghost commented Oct 6, 2023

Myster commented Oct 30, 2023

ghost commented Dec 14, 2023

kathleenwest commented Jan 1, 2024

mkArtakMSFT commented Jan 30, 2024

Refused to load _framework/aspnetcore-browser-refresh.js due to CSP #33068

Refused to load _framework/aspnetcore-browser-refresh.js due to CSP #33068

Comments

fingers10 commented May 27, 2021

Further technical details

ghost commented May 27, 2021

mkArtakMSFT commented Sep 12, 2021

donhuvy commented Sep 20, 2021

TanayParikh commented Oct 5, 2021

pranavkm commented Oct 5, 2021

gbjbaanb commented Oct 20, 2021

ASP-WAF commented Nov 7, 2021

flavio2201 commented Oct 4, 2022

aKzenT commented Aug 30, 2023

ghost commented Oct 6, 2023

Myster commented Oct 30, 2023

ghost commented Dec 14, 2023

kathleenwest commented Jan 1, 2024

mkArtakMSFT commented Jan 30, 2024

Refused to load `_framework/aspnetcore-browser-refresh.js` due to CSP #33068

Refused to load `_framework/aspnetcore-browser-refresh.js` due to CSP #33068