Azure SignalR Service - Response Headers (How do I add/modify them?)

Ken Wee 20

Hi Guys,

We currently deployed an application that's using Azure SignalR Service for realtime dashboard updates and other uses. There's an ongoing internal InfoSec scan and the <resourse_name>.service.signalr.net endpoint was flagged with a medium risk finding due to the response not having a CSP (Content Security Policy) header.

The specific endpoint is https://<resourse_name>.service.signalr.net/client/negotiate....

Response Headers are currently the ff:

Screenshot 2024-10-21 at 10.46.43

InfoSec wants me to add a CSP header. How do I do that? Is this even possible? I can't seem to find any documentation on adding headers to this endpoint. Hope I could get some guidance.

Thanks in advanced!

Laxman Reddy Revuri 720 Reputation points Microsoft Vendor

2024-10-28T16:55:19.4033333+00:00
Hi @Ken Wee
Thanks for the question and using MS Q&A platform.

Adding a Content Security Policy (CSP) header to the Azure SignalR Service endpoint, it's important to note that Azure SignalR Service does not allow you to directly modify the response headers for its endpoints, including adding CSP headers. However, there are alternative approaches you can consider implementing CSP in your application.
Implementing CSP in Your Application

If your application is hosted on Azure App Service or any other web server, you can add CSP headers at the application level. Here’s how you can do it in an ASP.NET Core application:

Middleware Approach

You can create middleware to add the CSP header to all responses from your application. Here’s a simple example:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { app.Use(async (ctx, next) => { ctx.Response.Headers.Add("Content-Security-Policy", "default-src 'self';"); await next(); }); // Other middleware registrations app.UseRouting(); app.UseEndpoints(endpoints => { endpoints.MapHub<YourHub>("/yourhub"); }); }

Using Azure Front Door or Application Gateway

If you're using Azure Front Door or Application Gateway in front of your SignalR service, you can configure these services to add headers to responses. This would allow you to set a CSP header for requests routed through these services.

Web Server Configuration

If your application is running on a web server (like IIS), you can also configure the server to add CSP headers. For example, in IIS, you can add custom headers through the web.config file:

<configuration> <system.webServer> <httpProtocol> <customHeaders> <add name="Content-Security-Policy" value="default-src 'self';" /> </customHeaders> </httpProtocol> </system.webServer> </configuration>

Considerations for SignalR

While you cannot modify the headers sent by the Azure SignalR Service directly, ensure that your application that interacts with SignalR has appropriate CSP settings. This includes ensuring that any scripts or resources loaded from the SignalR service comply with your CSP.

I hope this information is helpful
Laxman Reddy Revuri 720 Reputation points Microsoft Vendor

2024-11-01T09:10:41.83+00:00

Hi @Ken Wee
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Laxman Reddy Revuri 720 Reputation points Microsoft Vendor

2024-11-04T03:13:53.4366667+00:00

Hi @Ken Wee
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ken Wee 20 Reputation points

2024-11-04T04:17:32.3166667+00:00

Hi I've upvoted your suggestion since it is a good way to approach it.

Using Azure Front Door was not feasible as this would add cost to the build.

As for the web server side config, this only worked when not using self hosted signalr hub. Did not work for Azure SignalR Service as the endpoint was managed by Azure.

I was able to get feedback from MS Support Engineer, and they did mention that adding response headers directly to the Azure SignalR Service endpoint was not possible as of today.
Ken Wee 20 Reputation points

2024-11-04T04:19:12.7966667+00:00

Hi,

I was able to get in touch with a MS Support Engineer. They mentioned that adding response headers directly to the Azure SignalR Service endpoint was not possible as of today.

Accepted answer

Laxman Reddy Revuri 720 Reputation points Microsoft Vendor

2024-11-05T07:59:20.98+00:00

Hi @Ken Wee
thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.
Ask: Azure SignalR Service - Response Headers (How do I add/modify them?)
**Solution:**Using Azure Front Door was not feasible as this would add cost to the build.

As for the web server side config, this only worked when not using self hosted signalr hub. Did not work for Azure SignalR Service as the endpoint was managed by Azure.

I was able to get feedback from MS Support Engineer, and they did mention that adding response headers directly to the Azure SignalR Service endpoint was not possible as of today.

Please don’t forget to Accept Answer and Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure SignalR Service - Response Headers (How do I add/modify them?)

0 additional answers

Your answer