Upgrading website to net7.0 causes Content Security Policy (CSP) violation during AD B2C authentication

Question

I upgraded a Blazor WASM project from net6.0 version to <TargetFramework>net7.0</TargetFramework>. This caused the login to fail to AD B2C with error "Refused to run the JavaScript URL because it violates the following Content Security Policy directive" as detailed in this thread: https://learn.microsoft.com/en-us/answers/questions/1112519/login-failed-to-ad-b2c-with-error-34refused-to-run.html

My question is how to fix the upgrade to net7.0 to avoid this error?

Answer 1

@BlazorDevCanada
Thank you for your post and I apologize for the delayed response!

Error Message:
Refused to run the JavaScript URL because it violates the following Content Security Policy directive: “script-src ‘strict-dynamic’ ‘self’ ‘none-p2fIOc/End3Hsl7YddpafW==’ ‘report-sample’”. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-…’) or a none (‘nonce-…’) is required to enable inline execution...

From the B2C side of things, and from your previous thread's error message, it looks like this might be an issue with your Blazor WASM app running into a Content Security Policy issue after upgrading the project from Net6.0 version to Net7.0.

After looking into this a bit more, I found a troubleshooting section when following the Secure a hosted ASP.NET Core Blazor WebAssembly app with Azure Active Directory B2C documentation that might give you some more insights when troubleshooting this issue.

-----------------------------------

App upgrades:
A functioning app may fail immediately after upgrading either the .NET Core SDK on the development machine or changing package versions within the app. In some cases, incoherent packages may break an app when performing major upgrades. Most of these issues can be fixed by following these instructions:

1. Clear the local system's NuGet package caches by executing dotnet nuget locals all --clear from a command shell.
2. Delete the project's bin and obj folders.
3. Restore and rebuild the project.
4. Delete all of the files in the deployment folder on the server prior to redeploying the app.

Note: Use of package versions incompatible with the app's target framework isn't supported. For information on a package, use the NuGet Gallery or FuGet Package Explorer.

If the App upgrade troubleshooting steps don't help resolve your issue, I'd also recommend seeing if you can enable Blazor WebAssembly authentication logging to see if we can further debug your Blazor WebAssembly authentication.

Additional Links:
Run the Server app - Testing and troubleshooting a hosted Blazor WebAssembly solution.
.NET WebAssembly build tools - This section explains .NET 7 version of the build tools are incompatible with existing projects built with .NET 6.
Blazor Forum - Blazor Stack Overflow forum
Blazor Glitter - Discussion on Blazor, a framework for building web apps with .NET and WebAssembly
ASP.NET Core Product Unit Issues - For non-security, non-sensitive, and non-confidential reproducible framework bug reports
Content Security Policy error on login Azure B2C pages - Related Issue

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.