为什么我会收到此内容政策错误？

Question

我已使用 NWebSec 将以下内容添加到我的 Blazor Interactive Server 应用程序中：

app.UseHsts(options => options.MaxAge(days: 30));
app.UseXContentTypeOptions();
app.UseXXssProtection(options => options.EnabledWithBlockMode());
app.UseXfo(options => options.SameOrigin());
app.UseReferrerPolicy(opts => opts.NoReferrerWhenDowngrade());

app.UseCsp(options => options
    .DefaultSources(s => s.Self()
        .CustomSources("data:", "https:"))
    .StyleSources(s => s.Self()
        .CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
            "fonts.googleapis.com")
        .UnsafeInline()
    )
    .ImageSources(s => s.Self()
        .CustomSources("data:", "https:"))
    .FontSources(s => s.Self()
        .CustomSources("fonts.googleapis.com"))
    .ScriptSources(s => s.Self()
        .CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
            "cse.google.com")
        .UnsafeInline()
        .UnsafeEval()
    )
    .WorkerSources(s => s.Self()
        .CustomSources("louishowe-dev.azurewebsites.net", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net"))
);

// NWebSec does not handle this (no updates to that library in 4 years)
app.Use(async (context, next) =>
{
    context.Response.Headers.Add("Permissions-Policy", "geolocation=*, camera=(), microphone=()");
    await next.Invoke();
});

我收到错误：

Refused to load the font '<URL>' because it violates the following Content Security Policy directive: "font-src 'self' fonts.googleapis.com".
Understand this error

Refused to create a worker from 'blob:https://louishowe-dev.azurewebsites.net/02bff816-5188-44d1-9395-484a2964920e' because it violates the following Content Security Policy directive: "worker-src 'self' louishowe-dev.azurewebsites.net *.microsoft.com *.windows.net *.azurewebsites.net".

Uncaught SecurityError: Failed to construct 'Worker': Access to the script at 'blob:https://louishowe-dev.azurewebsites.net/02bff816-5188-44d1-9395-484a2964920e' is denied by the document's Content Security Policy.

我相信这两个网址都已明确设置为允许的。我将

louishowe-dev.azurewebsites.net

与

*.azurewebsites.net

一起设置为事件。但它不会创造工人。我做错了什么？

对于字体，不确定我需要启用什么才能允许

<URL>

。

Answer 1

我一切都正常了（感谢 JalpalPanchal，他解释了这一切）：

app.UseHsts(options => options.MaxAge(days: 30));
app.UseXContentTypeOptions();
app.UseXXssProtection(options => options.EnabledWithBlockMode());
app.UseXfo(options => options.SameOrigin());
app.UseReferrerPolicy(opts => opts.NoReferrerWhenDowngrade());

app.UseCsp(options => options
    .DefaultSources(s => s.Self()
        .CustomSources("data:", "https:"))
    .StyleSources(s => s.Self()
        .CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
            "fonts.googleapis.com")
        .UnsafeInline()
    )
    .ImageSources(s => s.Self()
        .CustomSources("blob:", "data:", "https:"))
    .FontSources(s => s.Self()
        .CustomSources("fonts.googleapis.com", "fonts.gstatic.com", "*.microsoft.com",
            "*.windows.net", "*.azurewebsites.net"))
    .ScriptSources(s => s.Self()
        .CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
            "cse.google.com")
        .UnsafeInline()
        .UnsafeEval()
    )
    .WorkerSources(s => s.Self()
        .CustomSources("blob:", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net"))
);

// NWebSec does not handle this 
app.Use(async (context, next) =>
{
    context.Response.Headers.Add("Permissions-Policy", "geolocation=*, camera=(), microphone=()");
    await next.Invoke();
});