dotnet / dotnet/aspnetcore

Add SRI Hash support to Static Web Assets in Blazor

Open
#61,180 6 comments 0 reactions 0 assignees View on GitHub
area-blazor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I'm trying to calculate SRI hashes for the static web assets in my Blazor Web App.
At the moment, the suggested way for static data is simply to calculate it elsewhere and paste the SRI hash into my App..razor.
See https://learn.microsoft.com/en-us/aspnet/core/blazor/security/content-security-policy?view=aspnetcore-9.0#adopt-subresource-integrity-sri

I'd like an built-in way to do that

### Describe the solution you'd like

Something like a new method in ComponentBase, similar to ``Assets``, called ``AssetIntegrity``
```csharp

```

### Additional context

I looked at the build-time staticwebassets.build.json, there is already a property called Integrity, which is used for ETag and (I think) for ``ImportMap``. https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/static-files?view=aspnetcore-9.0#import-maps

I looked at runtime into the data structures behind ``Assets``, ``ResourceAssetCollection``, but I couldn't find the ``Integrity`` property anywhere.

There is some prior discussins about CSP in https://github.com/dotnet/aspnetcore/issues/6001, but that includes a fully features CSP builder.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.