How to Allow Google fonts in IdentityServer4

Question

To use Google fonts in IdentityServer3, the following Content-Security-Policy never worked:

<meta http-equiv="Content-Security-Policy" 
      content=" style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
                font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:">

Instead we configured the CspOptions in the idsrvApp.UseIdentityServer constructor which did work:

CspOptions = new CspOptions {
    FontSrc = "https://fonts.gstatic.com",
    StyleSrc = "https://fonts.googleapis.com",
    Enabled = true
}

How can we configure CspOptions in IdentityServer4? I'm having trouble finding it.

Answer 1

For anyone else who gets stuck, the SecurityHeadersAttribute.cs file that comes with the IdentityServer4 quickstart files needs to be modified. Appending the following lines fixed it:

var csp = "default-src 'self'; object-src 'none'; frame-ancestors 'none'; sandbox allow-forms allow-same-origin allow-scripts; base-uri 'self';";

// These two lines enable google fonts
csp += "font-src 'self' https://fonts.gstatic.com;";
csp += "style-src 'self' https://fonts.googleapis.com;";

The file is located in quickstart/SecurityHeadersAttribute.cs