Merge pull request #45 from DuendeSoftware/mb/csp

Add CSP for fonts

Author: maartenba

src/Duende.IdentityServer.Demo.csproj

@@ -8,7 +8,7 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Duende.IdentityServer" Version="7.4.3" />
+		<PackageReference Include="Duende.IdentityServer" Version="7.4.6" />
 		<PackageReference Include="Duende.AspNetCore.Authentication.JwtBearer" Version="0.3.0" />
 		<PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
 	</ItemGroup>

src/Pages/SecurityHeadersAttribute.cs

@@ -33,6 +33,9 @@ public override void OnResultExecuting(ResultExecutingContext context)
             //csp += "upgrade-insecure-requests;";
             // also an example if you need client images to be displayed from twitter
             // csp += "img-src 'self' https://pbs.twimg.com;";
+            
+            // Google Fonts
+            csp += "font-src 'self' fonts.gstatic.com; style-src 'self' fonts.googleapis.com";
 
             // once for standards compliant browsers
             if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))