Class CspOptions

Namespace

Fdyay.IdentityServer.Configuration

Assembly

Fdyay.IdentityServer.Core.dll

Content-Security-Policy settings for this server's own pages.

public class CspOptions

Inheritance

object

CspOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Properties

AddDeprecatedHeaders

Whether to also send the headers browsers used before CSP Level 2. Defaults to true.

public bool AddDeprecatedHeaders { get; set; }

Property Value

bool

Remarks

X-Frame-Options: DENY and X-Content-Security-Policy. Both are superseded and both are still the only thing an old browser reads, and the page they protect is one where a single click grants an application access to a user's data. Turning them off is for a deployment that knows what its users run.

Level

The CSP version to write policies for. Defaults to Two.

public CspLevel Level { get; set; }

Property Value

CspLevel

Remarks

It decides two real things rather than a syntax flavour. frame-ancestors is Level 2, so at Level 1 the framing refusal rests entirely on X-Frame-Options — which is why lowering this without AddDeprecatedHeaders leaves the approval screens framable. Hash sources are Level 2 too, so the check-session iframe falls back to 'unsafe-inline' for its own script.