Add BrowserLinkNonceMiddleware for CSP nonce injection

Introduced BrowserLinkNonceMiddleware to inject CSP nonces into BrowserLink and ASP.NET Core hot-reload script tags during development. Added BrowserLinkNonceStartupFilter to ensure the middleware runs outermost in the pipeline. Provided AddUmbrellaBrowserLinkNonce extension for easy DI registration. Updated usings as needed.

Author: Richard Edwards

AspNetCore/src/Umbrella.AspNetCore.WebUtilities/IServiceCollectionExtensions.cs

@@ -1,6 +1,8 @@
 
 using CommunityToolkit.Diagnostics;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Identity;
+using Umbrella.AspNetCore.WebUtilities.Middleware;
 using Umbrella.AspNetCore.WebUtilities.Components;
 using Umbrella.AspNetCore.WebUtilities.Components.Abstractions;
 using Umbrella.AspNetCore.WebUtilities.Components.Options;
@@ -140,4 +142,24 @@ public static IServiceCollection AddUmbrellaAspNetCoreWebUtilitiesAnonymousPhone
 
 		return services;
 	}
+
+	/// <summary>
+	/// Adds the <see cref="Umbrella.AspNetCore.WebUtilities.Middleware.BrowserLinkNonceMiddleware"/> to the pipeline via an <see cref="IStartupFilter"/>,
+	/// registering it as the outermost middleware so it can inject CSP nonces onto BrowserLink and
+	/// ASP.NET Core hot-reload script tags injected by development tooling.
+	/// This should only be called in Development environments.
+	/// </summary>
+	/// <param name="services">The services dependency injection container builder.</param>
+	/// <returns>The <see cref="IServiceCollection"/> dependency injection container builder.</returns>
+	/// <exception cref="ArgumentNullException">Thrown if <paramref name="services"/> is null.</exception>
+	public static IServiceCollection AddUmbrellaBrowserLinkNonce(this IServiceCollection services)
+	{
+		Guard.IsNotNull(services, nameof(services));
+
+		// Insert at 0 so our startup filter is resolved first and therefore runs outermost in the pipeline.
+		// ASP.NET Core applies startup filters in reverse DI registration order, so index 0 = outermost wrapper.
+		services.Insert(0, ServiceDescriptor.Transient<IStartupFilter, BrowserLinkNonceStartupFilter>());
+
+		return services;
+	}
 }

AspNetCore/src/Umbrella.AspNetCore.WebUtilities/Middleware/BrowserLinkNonceMiddleware.cs

@@ -0,0 +1,89 @@
+using System.Text;
+using System.Text.RegularExpressions;
+using CommunityToolkit.Diagnostics;
+using Microsoft.AspNetCore.Http;
+using Umbrella.WebUtilities.Security;
+
+namespace Umbrella.AspNetCore.WebUtilities.Middleware;
+
+/// <summary>
+/// Middleware that injects a CSP nonce attribute onto Visual Studio BrowserLink and ASP.NET Core
+/// hot-reload script tags that are automatically inserted into HTML responses during development.
+/// Must be registered as the outermost middleware via <see cref="BrowserLinkNonceStartupFilter"/>.
+/// </summary>
+public partial class BrowserLinkNonceMiddleware
+{
+	#region Private Members
+	[GeneratedRegex(@"(<script\b[^>]*\bsrc=""/_vs/browserLink""[^>]*?)(>)", RegexOptions.IgnoreCase)]
+	private static partial Regex BrowserLinkPattern();
+
+	[GeneratedRegex(@"(<script\b[^>]*\bsrc=""/_framework/aspnetcore-browser-refresh\.js""[^>]*?)(>)", RegexOptions.IgnoreCase)]
+	private static partial Regex BrowserRefreshPattern();
+
+	private readonly RequestDelegate _next;
+	#endregion
+
+	#region Constructors
+	/// <summary>
+	/// Initializes a new instance of the <see cref="BrowserLinkNonceMiddleware"/> class.
+	/// </summary>
+	/// <param name="next">The next middleware in the pipeline.</param>
+	public BrowserLinkNonceMiddleware(RequestDelegate next)
+	{
+		_next = next;
+	}
+	#endregion
+
+	#region Middleware Members
+	/// <summary>
+	/// Invokes the middleware for the specified <see cref="HttpContext"/>.
+	/// </summary>
+	/// <param name="context">The <see cref="HttpContext"/>.</param>
+	/// <param name="nonceContext">The <see cref="NonceContext"/> for the current request.</param>
+	/// <returns>An awaitable <see cref="Task"/>.</returns>
+	public async Task InvokeAsync(HttpContext context, NonceContext nonceContext)
+	{
+		Guard.IsNotNull(context, nameof(context));
+		Guard.IsNotNull(nonceContext, nameof(nonceContext));
+
+		Stream originalBody = context.Response.Body;
+
+		using var buffer = new MemoryStream();
+		context.Response.Body = buffer;
+
+		try
+		{
+			await _next(context);
+		}
+		finally
+		{
+			context.Response.Body = originalBody;
+		}
+
+		// Nonce is set by security middleware during _next — read it after the inner pipeline completes.
+		string? nonce = nonceContext.Current;
+
+		string? contentType = context.Response.ContentType;
+		bool isHtml = !string.IsNullOrEmpty(contentType) &&
+					  contentType.Contains("text/html", StringComparison.OrdinalIgnoreCase);
+
+		if (string.IsNullOrEmpty(nonce) || !isHtml)
+		{
+			buffer.Position = 0;
+			await buffer.CopyToAsync(originalBody);
+			return;
+		}
+
+		buffer.Position = 0;
+		string html = Encoding.UTF8.GetString(buffer.GetBuffer(), 0, (int)buffer.Length);
+
+		string replacement = $"$1 nonce=\"{nonce}\"$2";
+		html = BrowserLinkPattern().Replace(html, replacement);
+		html = BrowserRefreshPattern().Replace(html, replacement);
+
+		byte[] modifiedBytes = Encoding.UTF8.GetBytes(html);
+		context.Response.ContentLength = modifiedBytes.Length;
+		await originalBody.WriteAsync(modifiedBytes);
+	}
+	#endregion
+}

AspNetCore/src/Umbrella.AspNetCore.WebUtilities/Middleware/BrowserLinkNonceStartupFilter.cs

@@ -0,0 +1,19 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+
+namespace Umbrella.AspNetCore.WebUtilities.Middleware;
+
+/// <summary>
+/// An <see cref="IStartupFilter"/> that registers <see cref="BrowserLinkNonceMiddleware"/> as the
+/// outermost middleware in the pipeline. This ensures it wraps the BrowserLink and browser-refresh
+/// startup-filter middlewares and can inject nonces after they have written their script tags.
+/// </summary>
+public sealed class BrowserLinkNonceStartupFilter : IStartupFilter
+{
+	/// <inheritdoc />
+	public Action<IApplicationBuilder> Configure(Action<IApplicationBuilder> next) => app =>
+	{
+		_ = app.UseMiddleware<BrowserLinkNonceMiddleware>();
+		next(app);
+	};
+}