diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Script/AbpNonceTagHelper.cs b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpNonceScriptTagHelper.cs similarity index 72% rename from framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Script/AbpNonceTagHelper.cs rename to framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpNonceScriptTagHelper.cs index 02431c616a..bc687f0474 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Script/AbpNonceTagHelper.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpNonceScriptTagHelper.cs @@ -1,20 +1,18 @@ using Microsoft.AspNetCore.Mvc.Rendering; using Microsoft.AspNetCore.Mvc.ViewFeatures; using Microsoft.AspNetCore.Razor.TagHelpers; +using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers; -namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Script; +namespace Volo.Abp.AspNetCore.Mvc.UI.Bundling.TagHelpers; - -[HtmlTargetElement("script", Attributes = "abp-nonce")] -public class AbpNonceTagHelper : AbpTagHelper +[HtmlTargetElement("script")] +public class AbpNonceScriptTagHelper : AbpTagHelper { [HtmlAttributeNotBound] [ViewContext] public ViewContext ViewContext { get; set; } - public override void Process(TagHelperContext context, TagHelperOutput output) { - output.Attributes.RemoveAll("abp-nonce"); if (ViewContext.HttpContext.Items.TryGetValue(AbpAspNetCoreConsts.ScriptNonceKey, out var nonce) && nonce is string nonceString && !string.IsNullOrEmpty(nonceString)) { output.Attributes.Add("nonce", nonceString); diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeaderNonceHelper.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeaderNonceHelper.cs new file mode 100644 index 0000000000..9ccf3bdb99 --- /dev/null +++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeaderNonceHelper.cs @@ -0,0 +1,23 @@ +using Microsoft.AspNetCore.Html; +using Microsoft.AspNetCore.Mvc.Rendering; + +namespace Volo.Abp.AspNetCore.Security; + +public static class AbpSecurityHeaderNonceHelper +{ + public static string GetScriptNonce(this IHtmlHelper htmlHelper) + { + if (htmlHelper.ViewContext.HttpContext.Items.TryGetValue(AbpAspNetCoreConsts.ScriptNonceKey, out var nonce) && nonce is string nonceString && !string.IsNullOrEmpty(nonceString)) + { + return nonceString; + } + + return string.Empty; + } + + public static string GetScriptNonceAttribute(this IHtmlHelper htmlHelper) + { + var nonce = htmlHelper.GetScriptNonce(); + return string.IsNullOrEmpty(nonce) ? string.Empty : $"nonce=\"{nonce}\""; + } +} \ No newline at end of file