Lombiq Helpful Libraries - Orchard Core Libraries - Security

October 28, 2025 ยท View on GitHub

There is a similar section for security extensions related to ASP.NET Core here. All of the services mentioned in both documents are included in the ConfigureSecurityDefaults() and ConfigureSecurityDefaultsWithStaticFiles() extensions.

These extensions provide additional security and can resolve issues reported by the ZAP security scanner.

Extensions

  • SecurityOrchardCoreBuilderExtensions: Adds BuilderExtensions extensions. For example, the ConfigureSecurityDefaultsWithStaticFiles() that provides some default security configuration for Orchard Core.

Attributes

  • ContentSecurityPolicyAttribute: You can add the [ContentSecurityPolicy(value, name)] attribute to any MVC action's method. This way you can grant per-action content security policy permissions, right there in the controller. These attributes are handled by the ContentSecurityPolicyAttributeContentSecurityPolicyProvider.

Services

  • ExternalLoginContentSecurityPolicyProvider: Provides various directives for the Content-Security-Policy header, allowing using external login providers that require special headers (like Microsoft login). Is automatically enabled when the affected features are enabled.
  • GoogleAnalyticsContentSecurityPolicyProvider: Provides various directives for the Content-Security-Policy header, allowing using Google Analytics tracking. Is automatically enabled when the OrchardCore.Google.Analytics feature is enabled or the provider is explicitly enabled for the current request via is static method.
  • ReCaptchaContentSecurityPolicyProvider: Provides various directives for the Content-Security-Policy header, allowing using ReCaptcha captchas. Is automatically enabled when the OrchardCore.ReCaptcha feature is enabled.
  • ResourceManagerContentSecurityPolicyProvider: An abstract base class for implementing content security policy providers that trigger when the specified resource is included.
  • VueContentSecurityPolicyProvider: An implementation of ResourceManagerContentSecurityPolicyProvider that adds script-src: unsafe-eval permission to the page if it uses the vuejs resource. This includes any Vue.js resource in stock Orchard Core and the one in Lombiq.VueJs.Resources as well. This is necessary, because without unsafe-eval Vue.js only supports templates that are pre-compiled into JS code.

You can configure optional or custom content security policy providers by implementing the IContentSecurityPolicyProvider interface and registering them in the DI container with AddContentSecurityPolicyProvider<TProvider>(), e.g. services.AddContentSecurityPolicyProvider<XWidgetsContentSecurityPolicyProvider>(); in a Startup class. You can also register providers for the whole app (i.e. all tenants) from the root Program class via OrchardCoreBuilder.ApplicationServices.