dotnet / dotnet/aspnetcore

WebAssembly.Authentication breaks content security policy, requires unsafe-eval

Open
#64,952 1 comment 2 reactions 0 assignees View on GitHub
area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

As of .NET 10, the WebAssembly.Authentication component's AuthenticationService.js has started using unsafe in-line JavaScript code that breaks any reasonable content security policy and would require allowing `unsafe-eval` to support.

### Expected Behavior

The authentication service code should continue working without errors as it did in .NET 8.

### Steps To Reproduce

Include `` in index.html as directed by [the documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/standalone-with-authentication-library?view=aspnetcore-10.0&tabs=visual-studio#index-page). The script uses unsafe in-line JavaScript which browsers will reject with a CSP in place:

Image

### Exceptions (if any)

Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'wasm-unsafe-eval' 'unsafe-hashes' 'sha256-7GxsRvgFpVoJjAvfMygeJfE+Nw3Ym69Ws0pNp7rTcJo=' 'sha256-6wDxxuAzeg/60+1CAAt5rbL08qT/A0H+gL/7CQENXto='” (Missing 'unsafe-eval')

### .NET Version

10.0.101

### Anything else?

Using Microsoft.AspNetCore.Components.WebAssembly.Authentication version 10.0.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.