Add AbpSecurityHeader ignore attribute

framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs

@@ -33,11 +33,23 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
 
         var requestAcceptTypeHtml = context.Request.Headers["Accept"].Any(x =>
             x.Contains("text/html") || x.Contains("*/*") || x.Contains("application/xhtml+xml"));
+            
+        var endpoint = context.GetEndpoint();
+        
+        if (endpoint != null)
+        {
+            var ignore = endpoint.Metadata.GetMetadata<IgnoreAbpSecurityHeaderAttribute>() != null;
+            if (ignore)
+            {
+                await next.Invoke(context);
+                return;
+            }
+        }
 
         if (!requestAcceptTypeHtml 
             || !Options.Value.UseContentSecurityPolicyHeader 
             || await AlwaysIgnoreContentTypes(context) 
-            || context.GetEndpoint() == null
+            || endpoint == null
             || Options.Value.IgnoredScriptNoncePaths.Any(x => context.Request.Path.StartsWithSegments(x.EnsureStartsWith('/'))))
         {
             AddOtherHeaders(context);

framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/IgnoreAbpSecurityHeader.cs

@@ -0,0 +1,8 @@
+using System;
+
+namespace Volo.Abp.AspNetCore.Security;
+
+public class IgnoreAbpSecurityHeaderAttribute : Attribute
+{
+    
+}

modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/AuthorizeController.cs

@@ -10,6 +10,7 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Primitives;
 using OpenIddict.Abstractions;
 using OpenIddict.Server.AspNetCore;
+using Volo.Abp.AspNetCore.Security;
 using Volo.Abp.OpenIddict.ViewModels.Authorization;
 
 namespace Volo.Abp.OpenIddict.Controllers;
@@ -19,7 +20,7 @@ namespace Volo.Abp.OpenIddict.Controllers;
 public class AuthorizeController : AbpOpenIdDictControllerBase
 {
     [HttpGet, HttpPost]
-    [IgnoreAntiforgeryToken]
+    [IgnoreAntiforgeryToken, IgnoreAbpSecurityHeader]
     public virtual async Task<IActionResult> HandleAsync()
     {
         var request = await GetOpenIddictServerRequestAsync(HttpContext);