Add UseSecurityHeaders option to disable CSP

CGI-FR · Jun 29, 2022 · 64d4b07 · 64d4b07
1 parent e8668a7
commit 64d4b07
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 6 deletions.
diff --git a/src/AzureIoTHub.Portal/Server/ConfigHandler.cs b/src/AzureIoTHub.Portal/Server/ConfigHandler.cs
@@ -15,6 +15,7 @@ public abstract class ConfigHandler
         internal const string DPSConnectionStringKey = "IoTDPS:ConnectionString";
         internal const string DPSServiceEndpointKey = "IoTDPS:ServiceEndpoint";
         internal const string DPSIDScopeKey = "IoTDPS:IDScope";
+        internal const string UseSecurityHeadersKey = "UseSecurityHeaders";
 
         internal const string OIDCScopeKey = "OIDC:Scope";
         internal const string OIDCAuthorityKey = "OIDC:Authority";
@@ -63,6 +64,8 @@ internal static ConfigHandler Create(IWebHostEnvironment env, IConfiguration con
 
         internal abstract string StorageAccountConnectionString { get; }
 
+        internal abstract bool UseSecurityHeaders { get; }
+
         internal abstract string OIDCScope { get; }
 
         internal abstract string OIDCApiClientId { get; }

diff --git a/src/AzureIoTHub.Portal/Server/DevelopmentConfigHandler.cs b/src/AzureIoTHub.Portal/Server/DevelopmentConfigHandler.cs
@@ -30,6 +30,8 @@ internal DevelopmentConfigHandler(IConfiguration config)
 
         internal override string StorageAccountConnectionString => this.config[StorageAccountConnectionStringKey];
 
+        internal override bool UseSecurityHeaders => this.config.GetValue(UseSecurityHeadersKey, true);
+
         internal override string OIDCScope => this.config[OIDCScopeKey];
 
         internal override string OIDCAuthority => this.config[OIDCAuthorityKey];

diff --git a/src/AzureIoTHub.Portal/Server/ProductionConfigHandler.cs b/src/AzureIoTHub.Portal/Server/ProductionConfigHandler.cs
@@ -30,6 +30,8 @@ internal ProductionConfigHandler(IConfiguration config)
 
         internal override string StorageAccountConnectionString => this.config.GetConnectionString(StorageAccountConnectionStringKey);
 
+        internal override bool UseSecurityHeaders => this.config.GetValue(UseSecurityHeadersKey, true);
+
         internal override string OIDCScope => this.config[OIDCScopeKey];
 
         internal override string OIDCAuthority => this.config[OIDCAuthorityKey];

diff --git a/src/AzureIoTHub.Portal/Server/Startup.cs b/src/AzureIoTHub.Portal/Server/Startup.cs
@@ -277,19 +277,24 @@ public async void Configure(IApplicationBuilder app, IWebHostEnvironment env)
             ArgumentNullException.ThrowIfNull(env, nameof(env));
             ArgumentNullException.ThrowIfNull(app, nameof(app));
 
+            var configuration = app.ApplicationServices.GetService<ConfigHandler>();
+
             // Use problem details
             _ = app.UseProblemDetails();
             app.UseIfElse(IsApiRequest, UseApiExceptionMiddleware, UseUIExceptionMiddleware);
 
-            _ = app.UseSecurityHeaders(opts =>
+            if (configuration.UseSecurityHeaders)
             {
-                _= opts.AddContentSecurityPolicy(csp =>
+                _ = app.UseSecurityHeaders(opts =>
                 {
-                    _ = csp.AddFrameAncestors()
-                        .Self()
-                        .From(app.ApplicationServices.GetService<ConfigHandler>().OIDCMetadataUrl);
+                    _ = opts.AddContentSecurityPolicy(csp =>
+                    {
+                        _ = csp.AddFrameAncestors()
+                            .Self()
+                            .From(configuration.OIDCMetadataUrl);
+                    });
                 });
-            });
+            }
 
             if (env.IsDevelopment())
             {