Cfrgtkky

For example if you have a CSP like
default-src 'self'; report-uri /CspViolationReport
and if /CspViolationReport is handled by ASP.Net, how do you access the CSP violation report that is posted?

We expect to find some JSON posted, e.g. http://www.w3.org/TR/CSP11/#example-violation-report

When you inspect Request.Form, there are no keys, and there is no evidence of it in Request.ServerVariables["ALL_RAW"], but Request.ServerVariables["HTTP_METHOD"] is "POST".

Intercepting the POST with Fiddler, you can see that the JSON is certainly being posted, but .Net doesn't seem to let you see it.

Here's a way, inspired by http://muaz-khan.blogspot.co.nz/2012/06/exploring-csp-content-security-policy.html, thanks!

void ProcessCspValidationReport() {

    Request.InputStream.Position = 0;

    using (StreamReader inputStream = new StreamReader(Request.InputStream))

    {

        string s = inputStream.ReadToEnd();

        if (!string.IsNullOrWhiteSpace(s))

        {

            CspPost cspPost = JsonConvert.DeserializeObject<CspPost>(s);

            //now you can access properties of cspPost.CspReport

        }

    }

}



class CspPost

{

    [JsonProperty("csp-report")]

    public CspReport CspReport { get; set; }

}



class CspReport

{

    [JsonProperty("document-uri")]

    public string DocumentUri { get; set; }



    [JsonProperty("referrer")]

    public string Referrer { get; set; }



    [JsonProperty("effective-directive")]

    public string EffectiveDirective { get; set; }



    [JsonProperty("violated-directive")]

    public string ViolatedDirective { get; set; }



    [JsonProperty("original-policy")]

    public string OriginalPolicy { get; set; }



    [JsonProperty("blocked-uri")]

    public string BlockedUri { get; set; }



    [JsonProperty("source-file")]

    public string SourceFile { get; set; }



    [JsonProperty("line-number")]

    public int LineNumber { get; set; }



    [JsonProperty("column-number")]

    public int ColumnNumber { get; set; }



    [JsonProperty("status-code")]

    public string StatusCode { get; set; }

}

Or you might just try CspBuilder.info :)

Here's one using DataContractJsonSerializer which is in namespaces System.Runtime.Serialization and System.Runtime.Serialization.Json no other libraries required, it's all in the .NET Framework.

Controller:

public class ReportingController : Controller

{



    [HttpPost]

    public void CspReport()

    {

        var context = System.Web.HttpContext.Current;



        context.Response.ContentType = "application/json";

        context.Response.ContentEncoding = Encoding.UTF8;



        using (IO.Stream body = context.Request.InputStream) {

            var ser = new DataContractJsonSerializer(typeof(CspReportContainer));

            var report = (CspReportContainer)ser.ReadObject(body);

            ReportingControllerHelper.LogCspReport(report.Report);

        }

    }

}

Model:

[DataContract()]

public class CspReportContainer

{

    [DataMember(Name = "csp-report")]

    public CspReport Report { get; set; }

}

[DataContract()]

public class CspReport

{

    [DataMember(Name = "blocked-uri")]

    public string BlockedUri { get; set; }

    [DataMember(Name = "column-number")]

    public int? ColumnNumber { get; set; }

    [DataMember(Name = "document-uri")]

    public string DocumentUri { get; set; }

    [DataMember(Name = "effective-directive")]

    public string EffectiveDirective { get; set; }

    [DataMember(Name = "line-number")]

    public int? LineNumber { get; set; }

    [DataMember(Name = "original-policy")]

    public string OriginalPolicy { get; set; }

    [DataMember(Name = "referrer")]

    public string Referrer { get; set; }

    [DataMember(Name = "source-file")]

    public string SourceFile { get; set; }

    [DataMember(Name = "status-code")]

    public int? StatusCode { get; set; }

    [DataMember(Name = "violated-directive")]

    public string ViolatedDirective { get; set; }

}

The problem might be with content-type of request: application/csp-report. I just added to WebApiConfig:

config.Formatters.JsonFormatter.SupportedMediaTypes.Add(

new System.Net.Http.Headers.MediaTypeHeaderValue("application/csp-report"));

Of course you also need clases form other answers: CspReportContainer, CspReport