在~/public/index.html中加CSP可能不起作用：
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
// ...
<meta http-equiv="Content-Security-Policy"
content="default-src 'self' https://abc.com;
img-src 'self' data: https://abc.com;
script-src 'self';
style-src 'self' 'unsafe-inline';
media-src 'self' https://abc.com;
frame-src 'self' https://abc.com;" />
// ...
</head>
<body>
// ...
</body>
</html>需要在~/public/web.config中添加：
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
<rewrite>
// ...
</rewrite>
<staticContent>
// ...
</staticContent>
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
<add name="X-Frame-Options" value="SAMEORIGIN" />
<add name="Content-Security-Policy" value="
default-src 'self' https://abc.com;
img-src 'self' data: https://abc.com;
script-src 'self';
style-src 'self' 'unsafe-inline';
media-src 'self' https://abc.com;
frame-src 'self' https://abc.com;
frame-ancestors 'self'"
/>
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>
扫一扫
2563
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
