WebAssembly.Authentication breaks content security policy, requires unsafe-eval
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
As of .NET 10, the WebAssembly.Authentication component's AuthenticationService.js has started using unsafe in-line JavaScript code that breaks any reasonable content security policy and would require allowing `unsafe-eval` to support.
### Expected Behavior
The authentication service code should continue working without errors as it did in .NET 8.
### Steps To Reproduce
Include `` in index.html as directed by [the documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/standalone-with-authentication-library?view=aspnetcore-10.0&tabs=visual-studio#index-page). The script uses unsafe in-line JavaScript which browsers will reject with a CSP in place:
### Exceptions (if any)
Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'wasm-unsafe-eval' 'unsafe-hashes' 'sha256-7GxsRvgFpVoJjAvfMygeJfE+Nw3Ym69Ws0pNp7rTcJo=' 'sha256-6wDxxuAzeg/60+1CAAt5rbL08qT/A0H+gL/7CQENXto='” (Missing 'unsafe-eval')
### .NET Version
10.0.101
### Anything else?
Using Microsoft.AspNetCore.Components.WebAssembly.Authentication version 10.0.1
Contributor guide
Assessment
This issue has not been assessed yet.