mcpField
S
syncfusion-aspnetcore-security

syncfusion-aspnetcore-security

github.com/syncfusionSecurity0109 installsUpdated 2w ago
Repository

About syncfusion-aspnetcore-security

syncfusion-aspnetcore-security is a skill for applying Content Security Policy to Syncfusion EJ2 controls in ASP.NET Core. It offers high-level guidance and points to separate reference files for implementation details.

Key features

  1. 01Syncfusion EJ2 CSP guidance
  2. 02Nonce setup for scripts and styles
  3. 03CDN and font allowlisting
  4. 04Strict CSP recommendations
  5. 05Browser violation verification

Use cases

  1. 01Configuring CSP headers for EJ2 controls
  2. 02Restricting inline scripts and styles
  3. 03Allowing required CDN and font origins

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/syncfusion/aspnetcore-ui-components-skills --skill syncfusion-aspnetcore-security

After installing, type/syncfusion-aspnetcore-securityin Claude Code to confirm it loaded.

Bundled filesreferences/csp-guide.md

Details

From the project README

Content Security Policy (CSP) — Syncfusion ASP.NET Core (Security)

Use this skill for high-level, Syncfusion-specific CSP guidance and references. Detailed code snippets and implementation examples live in the concern's references files.

When to Use

  • Implementing CSP headers for Syncfusion EJ2 controls
  • Running in strict CSP mode where inline scripts/styles are restricted
  • Adding nonces to inline scripts/styles for Syncfusion initialization
  • Allowlisting CDN resources or external fonts required by Syncfusion themes

Quick Checklist

  • Generate a cryptographically secure nonce per request
  • Add the nonce to the CSP header and to all Syncfusion script/style tags
  • Allow required CDN origins and font providers in CSP directives
  • Avoid unsafe-inline/unsafe-eval unless absolutely necessary
  • Verify behavior in browser DevTools and address CSP violations

Generic Guidelines (Summary)

  • Generate nonces early in the pipeline and store them in HttpContext for views
  • Use minimal, explicit CSP directives (prefer 'self', explicit hostnames, and 'nonce-<value>')
  • Prefer data binding over inline templates to avoid unsafe-eval requirements
  • Document your CSP policy and the reasons for any relaxations

References

Comments

Markdown supported