I'm working with ASP.NET MVC 5. I wrote a small filter attribute for adding Content Security Policy to response header. Here is the code:
public class ContentSecurityPolicyFilterAttribute : ActionFilterAttribute
{
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
HttpResponseBase response = filterContext.HttpContext.Response;
response.AddHeader("Content-Security-Policy", "default-src *; " +
"img-src * data:; " +
"style-src 'self' 'unsafe-inline' http://fonts.googleapis.com https://fonts.googleapis.com; " +
"script-src 'self' 'unsafe-inline' 'unsafe-eval' " +
"localhost:*/* " +
"https://facebook.com " +
"*.facebook.com " +
"https://facebook.net " +
"*.facebook.net " +
"https://onesignal.com " +
"*.onesignal.com " +
"https://abtasty.com *.abtasty.com *.convertexperiments.com " +
"http://www.googletagmanager.com " +
"https://www.googletagmanager.com " +
"http://www.google-analytics.com " +
"https://www.google-analytics.com " +
"http://www.googleadservices.com " +
"https://www.googleadservices.com ");
base.OnActionExecuting(filterContext);
}
}
To FilterConfig:
public class FilterConfig
{
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
//...
filters.Add(new ContentSecurityPolicyFilterAttribute());
}
}
My problem is that this code is adding more than one Content-Security-Policy header on every request. It should run once, and add this header one time only. Am I right?
So what can I to fix this problem ?