Skip to content

(DOTNET-123) Allow nonce attribute value to be passed in #134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jun 29, 2022
Merged

(DOTNET-123) Allow nonce attribute value to be passed in #134

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6185650
Merge branch 'develop'
Mar 16, 2022
c060206
Merge branch 'develop'
Apr 6, 2022
c5b4e4b
Merge branch 'develop'
May 2, 2022
a1a31c2
Merge branch 'develop'
May 2, 2022
4477626
DOTNET-116 add nonce attribute to script tag for CSP support
May 25, 2022
2e8103b
DOTNET-116 provide the ability to set a nonce value for the script
Jun 28, 2022
d57ef42
Merge remote-tracking branch 'origin/develop' into nonce-rumscript
danatcofo Jun 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions Src/StackifyLib/Web/RealUserMonitoring.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
using System;
using System;
using System.Security.Cryptography;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
Expand All @@ -9,8 +9,12 @@ namespace StackifyLib.Web
public static class RealUserMonitoring
{
private static readonly RandomNumberGenerator Rng = new RNGCryptoServiceProvider();

public static string GetHeaderScript()

/// <summary>
/// Generate the header script for including RUM
/// </summary>
/// <param name="nonce">nonce value, defaults to a cryptographic unique string if left null</param>
public static string GetHeaderScript(string nonce = null)
{
var rumScriptUrl = Config.RumScriptUrl;
var rumKey = Config.RumKey;
Expand Down Expand Up @@ -52,13 +56,16 @@ public static string GetHeaderScript()
settings["Trans"] = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(reportingUrl));
}

// generate nonce for strict CSP rules
return string.Format("<script type=\"text/javascript\" nonce=\"{3}\">(window.StackifySettings || (window.StackifySettings = {0}))</script><script src=\"{1}\" data-key=\"{2}\" async></script>",
settings.ToString(Formatting.None), rumScriptUrl, rumKey, nonce ?? GetNonce());
}

// generate nonce for strict CSP rules
private static string GetNonce()
{
var nonceBytes = new byte[20];
Rng.GetNonZeroBytes(nonceBytes);
var nonce = Convert.ToBase64String(nonceBytes);

return string.Format("<script type=\"text/javascript\" nonce=\"{3}\">(window.StackifySettings || (window.StackifySettings = {0}))</script><script src=\"{1}\" data-key=\"{2}\" async></script>",
settings.ToString(Formatting.None), rumScriptUrl, rumKey, nonce);
return Convert.ToBase64String(nonceBytes);
}
}
}