Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

'nonce' attribute of <mini-profiler /> taghelper does not work for stylesheet include #560

Closed
d-gibbs opened this issue May 18, 2021 · 2 comments · Fixed by #565
Closed

'nonce' attribute of <mini-profiler /> taghelper does not work for stylesheet include #560

d-gibbs opened this issue May 18, 2021 · 2 comments · Fixed by #565

Comments

@d-gibbs
Copy link

d-gibbs commented May 18, 2021

I'm using MiniProfiler.AspNetCore.Mvc v4.2.1 and attempting to set a nonce on the tag helper like so:

<mini-profiler nonce="@Html.CspScriptNonce()" />

I'm finding that the nonce is correctly being set on the <script /> includes file (trimmed):

<script async id="mini-profiler" src="/mini-profiler-resources/includes.min.js?v=4.2.1+b27bea37e9" data-version="4.2.1+b27bea37e9" data-path="/mini-profiler-resources/" data-authorized="true" nonce="YkvcvTp1dLG5AR1UaZvrOO0c"></script>

But not for the stylesheet:

<link rel="stylesheet" type="text/css" href="/mini-profiler-resources/includes.min.css?v=4.2.1+b27bea37e9">

Which then results in a bunch of CSP violations:

image

image

Is there a way that we can ensure the nonce gets applied to the MiniProfiler stylesheet include? At the moment it seems like the only option is to enable unsafe-inline for style-src which is not desireable.
@d-gibbs d-gibbs changed the title 'nonce' attribute of MiniProfiler taghelper does not work 'nonce' attribute of MiniProfiler taghelper does not work for stylesheet include May 18, 2021
@d-gibbs d-gibbs changed the title 'nonce' attribute of MiniProfiler taghelper does not work for stylesheet include 'nonce' attribute of <mini-profiler /> taghelper does not work for stylesheet include May 18, 2021
NickCraver pushed a commit that referenced this issue Jul 3, 2021
Fix for #560 - propagate nonce to <link>
e806e47 
This propagates the `nonce` attribute to the generated <link> element as it should for proper CSP handling.
@NickCraver NickCraver linked a pull request Jul 3, 2021 that will close this issue
Fix for #560 - propagate nonce to <link> #565
Merged
NickCraver added a commit that referenced this issue Jul 3, 2021
@NickCraver
Fix for #560 - propagate nonce to <link> (#565)
faf494f 
This propagates the `nonce` attribute to the generated <link> element as it should for proper CSP handling.
@NickCraver
Copy link
Member

Just pushed a fix for this - it'll be on the CI feed in a few minutes (see README), and likely on NuGet next week :)

@PhenX
Copy link

PhenX commented Nov 17, 2022

Any plan to release a new nuget package ? This is still not released apparently https://miniprofiler.com/dotnet/Releases

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix for #560 - propagate nonce to <link> MiniProfiler/dotnet
3 participants
@PhenX @NickCraver @d-gibbs