src/BCards.Web/Program.cs

@@ -581,10 +581,7 @@ builder.Services.AddHsts(options =>
 
 var app = builder.Build();
 
-app.UseForwardedHeaders(new ForwardedHeadersOptions
-{
-    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
-});
+app.UseForwardedHeaders();
 
 if (!app.Environment.IsDevelopment())
 {
@@ -610,19 +607,6 @@ app.Use(async (context, next) =>
     context.Response.Headers.Append("Referrer-Policy", "no-referrer");
     context.Response.Headers.Append("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
 
-    // Content Security Policy - Protects against XSS attacks
-    var csp = "default-src 'self'; " +
-              "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://code.jquery.com https://cdn.jsdelivr.net/npm/bootstrap@5.3.2 https://accounts.google.com https://apis.google.com; " +
-              "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com https://cdn.jsdelivr.net/npm/bootstrap@5.3.2; " +
-              "img-src 'self' data: https: blob:; " +
-              "font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net; " +
-              "connect-src 'self' https://accounts.google.com https://apis.google.com https://login.microsoftonline.com; " +
-              "frame-src 'self' https://accounts.google.com https://login.microsoftonline.com; " +
-              "object-src 'none'; " +
-              "base-uri 'self'; " +
-              "form-action 'self'";
-    context.Response.Headers.Append("Content-Security-Policy", csp);
-
     // Load balancer e debugging headers
     context.Response.Headers.Append("X-Server-ID", Environment.MachineName);
     context.Response.Headers.Append("X-Instance-ID", $"{Environment.MachineName}-{Environment.ProcessId}");