Add support for WSS in Content Security Policy default source directives for browser link

Author: marthijn

src/Sidio.Web.Security.Tests/Headers/Options/ContentSecurityPolicyHeaderOptionsBuilderExtensionsTests.cs

@@ -14,7 +14,7 @@ public void AppendBrowserLinkPolicy_ShouldAppendDirectives()
         var result = builder.AppendBrowserLinkPolicy();
 
         // Assert
-        result.Options.DefaultSrc.Should().Be("'unsafe-inline' http://localhost:* https://localhost:* ws://localhost:*");
+        result.Options.DefaultSrc.Should().Be("'unsafe-inline' http://localhost:* https://localhost:* ws://localhost:* wss://localhost:*");
         result.Options.ScriptSrc.Should().Be("'unsafe-inline' http://localhost:* https://localhost:*");
     }
 
@@ -35,7 +35,7 @@ public void AppendBrowserLinkPolicy_DirectivesAlreadyExist_ShouldAppendDirective
         var result = builder.AppendBrowserLinkPolicy();
 
         // Assert
-        result.Options.DefaultSrc.Should().Be("'self' 'unsafe-inline' http://localhost:* https://localhost:* ws://localhost:*");
+        result.Options.DefaultSrc.Should().Be("'self' 'unsafe-inline' http://localhost:* https://localhost:* ws://localhost:* wss://localhost:*");
         result.Options.ScriptSrc.Should().Be("'self' 'unsafe-inline' http://localhost:* https://localhost:*");
     }
 }

src/Sidio.Web.Security/Headers/Options/ContentSecurityPolicyHeaderOptionsBuilderExtensions.cs

@@ -20,6 +20,7 @@ public static ContentSecurityPolicyHeaderOptionsBuilder AppendBrowserLinkPolicy(
         const string HttpLocalhost = "http://localhost:*";
         const string HttpsLocalhost = "https://localhost:*";
         const string WsLocalhost = "ws://localhost:*";
+        const string WssLocalhost = "wss://localhost:*";
         const string Space = " ";
 
         builder.Options.DefaultSrc ??= string.Empty;
@@ -46,6 +47,11 @@ public static ContentSecurityPolicyHeaderOptionsBuilder AppendBrowserLinkPolicy(
             defaultSrcDirectives.Add(WsLocalhost);
         }
 
+        if (!builder.Options.DefaultSrc.Contains(WssLocalhost))
+        {
+            defaultSrcDirectives.Add(WssLocalhost);
+        }
+
         builder.Options.DefaultSrc += Space + string.Join(Space, defaultSrcDirectives);
         builder.Options.DefaultSrc = builder.Options.DefaultSrc.Trim();