Why am I getting this Content Policy error?

Question

I have added the following to my Blazor Interactive Server app using NWebSec:

app.UseHsts(options => options.MaxAge(days: 30));
app.UseXContentTypeOptions();
app.UseXXssProtection(options => options.EnabledWithBlockMode());
app.UseXfo(options => options.SameOrigin());
app.UseReferrerPolicy(opts => opts.NoReferrerWhenDowngrade());

app.UseCsp(options => options
    .DefaultSources(s => s.Self()
        .CustomSources("data:", "https:"))
    .StyleSources(s => s.Self()
        .CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
            "fonts.googleapis.com")
        .UnsafeInline()
    )
    .ImageSources(s => s.Self()
        .CustomSources("data:", "https:"))
    .FontSources(s => s.Self()
        .CustomSources("fonts.googleapis.com"))
    .ScriptSources(s => s.Self()
        .CustomSources("*.microsoft.com", "*.windows.net", "*.azurewebsites.net", "www.google.com",
            "cse.google.com")
        .UnsafeInline()
        .UnsafeEval()
    )
    .WorkerSources(s => s.Self()
        .CustomSources("louishowe-dev.azurewebsites.net", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net"))
);

// NWebSec does not handle this (no updates to that library in 4 years)
app.Use(async (context, next) =>
{
    context.Response.Headers.Add("Permissions-Policy", "geolocation=*, camera=(), microphone=()");
    await next.Invoke();
});

And I am getting the errors:

Refused to load the font '<URL>' because it violates the following Content Security Policy directive: "font-src 'self' fonts.googleapis.com".
Understand this error

Refused to create a worker from 'blob:https://louishowe-dev.azurewebsites.net/02bff816-5188-44d1-9395-484a2964920e' because it violates the following Content Security Policy directive: "worker-src 'self' louishowe-dev.azurewebsites.net *.microsoft.com *.windows.net *.azurewebsites.net".

Uncaught SecurityError: Failed to construct 'Worker': Access to the script at 'blob:https://louishowe-dev.azurewebsites.net/02bff816-5188-44d1-9395-484a2964920e' is denied by the document's Content Security Policy.

I believe both of those urls are explicitly set as allowed. I event set louishowe-dev.azurewebsites.net along with *.azurewebsites.net. And yet it won't create the worker. What am I doing wrong?

And for the font, not sure what I need to enable to allow <URL>.

Answer 1

For the font error you could add Google and any other trusted domains in allowed list:

FontSources`:`.FontSources(s => s.Self()
    .CustomSources("fonts.googleapis.com", "fonts.gstatic.com", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net")
)

and For the worker error, dynamically created workers using blob: URLs need to be explicitly allowed:

 .WorkerSources(s => s.Self()
    .CustomSources("blob:", "louishowe-dev.azurewebsites.net", "*.microsoft.com", "*.windows.net", "*.azurewebsites.net")
)