XperienceCommunity.CSP 5.0.1

Xperience Community: Content Security Policy (CSP) Management

Description

Adds a module to the admin site for easy configuration of Content Security Policy (CSP) headers for web channels.

Screenshots

Once installed, a new module appears in the navigation and the dashboard: <a href="/src/images/navigation-tile.jpg"> <img src="/src/images/navigation-tile.jpg" width="800" alt="CSP Management module in navigation"> </a>

Screen for creating a new CSP configuration (on a per source url basis): <a href="/src/images/create-new.jpg"> <img src="/src/images/create-new.jpg" width="800" alt="Create a new CSP configuration screen"> </a>

Listing shows all configurations, including which web channel they are assigned to. <a href="/src/images/csp-listing.jpg"> <img src="/src/images/csp-listing.jpg" width="800" alt="CSP configuration listing screen"> </a>

Additional Features

Library Version Matrix

Dependencies

• ASP.NET Core 8.0
• Xperience by Kentico

Package Installation

Add the package to your application using the .NET CLI

dotnet add package XperienceCommunity.CSP

Quick Start

1. Install NuGet package above.

2. Register the CSP management services using builder.Services.AddXperienceCommunityCspManagement():

   // Program.cs
   
   var builder = WebApplication.CreateBuilder(args);
   
   builder.Services.AddKentico();
   
   // ...
   
   builder.Services.AddXperienceCommunityCspManagement();
   

3. Register the CSP management middleware using app.UseXperienceCommunityCspManagement():

    var app = builder.Build();
   
    app.UseKentico();
   
    // ...
   
    app.UseXperienceCommunityCspManagement();
   

4. That's it, launch your website and the module should be installed ready to go! Once you've configured your CSP headers, load a page on the website and check the headers in your browser console.

Troubleshooting

Namespace clash after running code generation

This module installs its own database classes (XperienceCommunity.CSPConfiguration and XperienceCommunity.CSPViolationReport) when your application starts. If you run the Xperience code generator for classes (for example after an upgrade), it will generate a duplicate copy of these classes into your own project, because the module's classes are not excluded by default.

This leaves two classes registered for the same object type, which causes errors such as the following when deleting a single violation report (or CSP configuration) from the admin UI:

Unable to cast object of type 'XperienceCommunity.Classes.CSPViolationReport.CSPViolationReportInfo' to type 'XperienceCommunity.CSP.CSPViolationReportInfo'.

Fix: delete the duplicate generated classes from your project. They will have a namespace beginning with XperienceCommunity.Classes. (typically under a Classes/ folder), rather than the XperienceCommunity.CSP namespace shipped by the package.

Prevention: exclude this module's classes when you run code generation. You can target just this module, or exclude all community-package classes under the XperienceCommunity prefix:

# Exclude only this module's classes (recommended)
dotnet run --no-build -- --kxp-codegen --type "Classes" --exclude "XperienceCommunity.CSP*"

# Or exclude all XperienceCommunity.* community-package classes
dotnet run --no-build -- --kxp-codegen --type "Classes" --exclude "XperienceCommunity.*"

The --exclude pattern matches class names. This module registers XperienceCommunity.CSPConfiguration and XperienceCommunity.CSPViolationReport, so XperienceCommunity.CSP* targets exactly these two. XperienceCommunity.* is broader — it also excludes any other classes named with that prefix (including other community packages, or your own), so only use it if that is what you intend. This same clash can affect any community package whose classes are not excluded from generation.

Running the Example Project

The repository includes a Dancing Goat sample site in examples/DancingGoat, generated from the Xperience by Kentico 30.11.0 template, with this module wired up in Program.cs. To run it locally:

1. Create the database from the examples/DancingGoat folder. This uses the database manager version pinned in the project's tool manifest, so the schema and sample data match the Xperience version used by the example:

   cd examples/DancingGoat
   dotnet tool restore
   dotnet kentico-xperience-dbmanager -- -s "localhost" -d "CSP-DancingGoat" -a "<admin password>" --hash-string-salt "3a93ddd7-3de5-46a1-a363-dd3eed0a54c0" --sample-website-domain "localhost:53955" --license-file "<path to license file>"
   

   Adjust the server name and connection string in appsettings.json if you are not using a local default SQL Server instance. A license key valid for localhost is required for the site to render.

2. Run the site:

   dotnet run --project examples/DancingGoat/DancingGoat.csproj
   

3. Sign in to the administration at https://localhost:53955/admin and add configurations under CSP management.

Contributing

Feel free to submit issues or pull requests to the repository, this is a community package and everyone is welcome to support.

License

Distributed under the MIT License. See LICENSE.md for more information.