I’m utilizing FullCalendar.io in my Asp.Web core net app. Additionally I’ve setup CSP with NetEscapades.AspNetCore.SecurityHeaders.
Listed below are the definitions:
coverage.AddContentSecurityPolicy(builder =>
{
builder.AddDefaultSrc().Self();
builder.AddConnectSrc()
.From("wss://localhost:*")
.From("ws://localhost:*")
.From("https://localhost:*")
.From("http://localhost:*")
.Self();
builder.AddObjectSrc().Self();
builder.AddBlockAllMixedContent();
builder.AddImgSrc().Self().From("information:").OverHttps();
builder.AddFormAction().Self().OverHttps();
builder.AddFontSrc().Self().From("information:").OverHttps();
builder.AddStyleSrc()
.Self()
////.UnsafeInline()
.WithNonce()
.OverHttps();
builder.AddScriptSrc()
.Self()
.WithNonce()
.OverHttps();
builder.AddBaseUri().Self().OverHttps();
builder.AddFrameAncestors().Self().OverHttps();
builder.AddWorkerSrc().Self().OverHttps();
builder.AddManifestSrc().Self().OverHttps();
});
My calendar may be very fundamental:
$(doc).prepared(perform () {
var antiForgeryToken = $('enter[name = "AFTFFINNIA"]').val();
var calendarEl = doc.getElementById('calendar');
var calendar = new FullCalendar.Calendar(calendarEl, {
initialView: 'dayGridMonth',
locale: 'de-CH',
firstDay: 1,
peak: "auto",
headerToolbar: {
left: 'prev,subsequent right now',
heart: 'title',
proper: 'dayGridMonth,timeGridWeek,timeGridDay,listWeek'
},
occasions: {
url: '/Kalender/Termine',
methodology: 'POST',
extraParams: {
AFTFFINNIA: antiForgeryToken
},
},
});
calendar.render();
});
On chrome (home windows) this works high quality. However on iOS and macOS with safari, the calendar will not be being displayed.
Error message: Refused to use a stylesheet as a result of its hash, its nonce, or ‘unsafe-inline’ doesn’t seem int the style-src directive of the Content material Safety Coverage. (Index, line 1)
After this there’s a TypeError: null will not be an object (evaluating ‘i.cssRules’).
I did learn: Fullcalendar.io’s Content material Safety Coverage (CSP).
Anybody know why this doesn’t work on safari?
Content material-Safety-Coverage Header:
style-src 'self' https: 'nonce-+1v9CuQxiH8qkVG0PK4Lo/D/kV0oI2jIw7Eb2xxemXY=';
script-src 'self' https: 'nonce-+1v9CuQxiH8qkVG0PK4Lo/D/kV0oI2jIw7Eb2xxemXY=';
default-src 'self';
connect-src wss://localhost:* ws://localhost:* https://localhost:* http://localhost:* 'self';
object-src 'self';
block-all-mixed-content;
img-src 'self' information: https:;
form-action 'self' https:; font-src 'self' information: https:;
base-uri 'self' https:;
frame-ancestors 'self' https:;
worker-src 'self' https:;
manifest-src 'self' https:
