How to set Content Security Policy (CSP) Header Not Set for Azure Blob Static Website

Question

Hi Team,
I've resolved my problem about the proxy disclosure and now I undergo a problem about Content Security Ploicy (CSP) Header Not Set.
This is a screenshot displaying the case.

Thanks for your feedback

Answer 1

@Mosa REMBALA

Thank you for posting your query on Microsoft Q&A.

You can define configuration in the staticwebapp.config.json file, which controls the following settings:

https://learn.microsoft.com/en-us/azure/static-web-apps/configuration

• Routing
• Authentication
• Authorization
• Fallback rules
• HTTP response overrides
• Global HTTP header definitions
• Custom MIME types
• Networking

This file is used to define the configurations for your app, including custom headers.

Here's an example of how to add a Content Security Policy header in the staticwebapp.config.json file:

{
    "globalHeaders": {
      "content-security-policy": "default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'",
      "Access-Control-Allow-Origin": "*",
      "X-Frame-Options": "SAMEORIGIN",
      "X-Permitted-Cross-Domain-Policies": "none",
      "Referrer-Policy":"no-referrer",
      "X-Content-Type-Options": "nosniff",
      "Permissions-Policy": "autoplay=()"
  }
}

Answer 2

@Mosa REMBALA

Will be happy to hear back from you. Please make note that all configurations should be based on your project requirements.

Ex: "Access-Control-Allow-Origin": "" should be specific domain names.

Please take care.

Answer 3

@Arun Siripuram

I've applied the **staticwebapp.config.json **file in my deployment but nothing is changed.

Below is the steps that I did.

step 1: I created staticwebapp.config.json file in my app_location and I put it in the public subfolder.

{
    "globalHeaders": {
      "content-security-policy": "default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'",
      "Access-Control-Allow-Origin": "https://my-domain-name",
      "X-Frame-Options": "SAMEORIGIN",
      "X-Permitted-Cross-Domain-Policies": "none",
      "Referrer-Policy":"no-referrer",
      "X-Content-Type-Options": "nosniff",
      "Permissions-Policy": "autoplay=()"
  }
}

step 2: I deploy my app.

step 3: I test it via our check security. The result, Content Security Policy (CSP) Header Not Set is still persist.

Answer 4

@Mosa REMBALA

please check the location of the file

File location

The recommended location for the staticwebapp.config.json is in the folder set as the app_location in the workflow file. However, the file may be placed in any subfolder within the folder set as the app_location.

please do refer the below url.

https://learn.microsoft.com/en-us/azure/static-web-apps/configuration