From 5de1132c52e8a6f37be0b0ede4e15d359933a444 Mon Sep 17 00:00:00 2001
From: Salih <salihozkara00@gmail.com>
Date: Fri, 5 May 2023 14:47:30 +0300
Subject: [PATCH] Add Ignored Url

---
 .../Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs    | 2 +-
 .../Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
index c24d412fd0..9280aa7c35 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
@@ -31,7 +31,7 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
         
         var contentSecurityPolicyValueDictionary = Options.Value.ContentSecurityPolicyValueDictionary.ToDictionary(x=>x.Key, x=>x.Value);
 
-        if (Options.Value.UseContentSecurityPolicyHeader)
+        if (Options.Value.UseContentSecurityPolicyHeader && !Options.Value.IgnoredUrls.Any(x => context.Request.Path.StartsWithSegments(x.EnsureStartsWith('/'))))
         {
             if (Options.Value.UseContentSecurityPolicyNonce)
             {
diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
index 31bb7b28a7..7407aa8145 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
@@ -11,10 +11,13 @@ public class AbpSecurityHeadersOptions
     public Dictionary<string,IEnumerable<string>> ContentSecurityPolicyValueDictionary { get; }
 
     public Dictionary<string, string> Headers { get; }
+    
+    public List<string> IgnoredUrls { get; }
 
     public AbpSecurityHeadersOptions()
     {
         Headers = new Dictionary<string, string>();
         ContentSecurityPolicyValueDictionary = new Dictionary<string, IEnumerable<string>>();
+        IgnoredUrls = new List<string> { "/swagger" };
     }
 }