Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Refused to load `_framework/aspnetcore-browser-refresh.js` due to CSP
See original GitHub issueI’m working on .net 5 blazor wasm project. I recently updated my Visual Studio 2019 to version 16.10.0. All of a sudden I started getting an error message in my browser (Google Chrome) console as shown below:
Refused to load the script ‘https://localhost:44340/_framework/aspnetcore-browser-refresh.js’ because it violates the following Content Security Policy directive: “script-src ‘sha256-fa5rxHhZ799izGRP38+h4ud5QXNT0SFaFlh4eqDumBI=’”. Note that ‘script-src-elem’ was not explicitly set, so ‘script-src’ is used as a fallback.
I don’t have _framework/aspnetcore-browser-refresh.js added in my index.html. Here is the scripts and styles declaration in my index.html
styles declared inside <head> in index.html:
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
<title>App</title>
<base href="/" />
<link href="css/site.css" rel="stylesheet" />
<link href="Web.styles.css" rel="stylesheet">
<link href="_content/BlazorDateRangePicker/daterangepicker.min.css" rel="stylesheet" />
<link href="manifest.json" rel="manifest" />
<link rel="apple-touch-icon" sizes="512x512" href="icon-512.png" />
</head>
scripts in index.html:
<script src="_content/Microsoft.AspNetCore.Components.WebAssembly.Authentication/AuthenticationService.js"></script>
<script src="_framework/blazor.webassembly.js"></script>
<script src="js/Chart.js"></script>
<script src="js/print.js"></script>
<script src="js/pdf.js"></script>
<script src="_content/BlazorDateRangePicker/clickAndPositionHandler.js"></script>
<script src="js/blazorInterop.js"></script>
<script>navigator.serviceWorker.register('service-worker.js');</script>
But when I launch the app via visual studio, from the browser I can see that _framework/aspnetcore-browser-refresh.js gets appended to scripts section in my index.html. Here is the screen print.
This is anything related to my configuration error? or I need to setup CSP in my index.html? Please assist.
Further technical details
- ASP.NET Core version - 5.0.6
- The IDE (VS / VS Code/ VS4Mac) you’re running on, and its version - VS 16.0.0
Issue Analytics
- State:
- Created 2 years ago
- Comments:9 (5 by maintainers)
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
Thanks for contacting us.
We’re moving this issue to the
.NET 8 Planningmilestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s). If we later determine, that the issue has no community involvement, or it’s very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues. To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.The script has a couple of dynamic components which makes this tricky. I think one of the ideas was to a) Have a way to opt out of the script being auto-injected b) Add an environment variable that includes metadata so a user can reasonably configure their CSP.
Browserlink in VS which is now injected by default also has this issue, so we kinda have to make sure this scales (or figure out how to roll everything into a single import).