title: ASP.NET MVC HTML5 Boilerplate - Content Security Policy is killing all external scripts, even “whitelisted” ones
body: <p>Current Project:</p>
  
  <ul>
  <li>ASP.NET 4.5.2</li>
  <li>MVC 5</li>
  <li>HTML5 Boilerplate</li>
  <li>Google ReCaptcha (any NuGet package, take your pick, I’ve already churned through three of them)</li>
  </ul>
  
  <p>So it appears that anything from outside the <a href="http://www.taskgenerator.ca/demo/" rel="nofollow">site I am developing</a> gets stopped, <em>cold</em>, by the Content Security Policy. Yes, there is supposed to be a Google ReCaptcha at the bottom of that form. Don’t see it? Yeah… This is <em>despite</em> things like <code>ajax.googleapis.com</code> being supposedly “whitelisted” through <code>FilterConfig.cs</code>.</p>
  
  <p>When I go to my site and try to load it, I get the console error:</p>
  
  <pre><code>Content Security Policy: The page's settings blocked the loading of a resource at https://www.google.com/recaptcha/api.js ("script-src http://http://www.taskgenerator.ca http://localhost:* http://ajax.googleapis.com http://ajax.aspnetcdn.com").
  </code></pre>
  
  <p>When I add <code>www.google.com</code> to the <code>CspScriptSrcAttribute()</code> inside <code>FilterConfig.cs</code>, I get the following error:</p>
  
  <pre><code>Content Security Policy: The page's settings blocked the loading of a resource at https://www.gstatic.com/recaptcha/api2/r20160913151359/recaptcha__en.js ("script-src http://http://www.taskgenerator.ca http://localhost:* http://www.google.com http://ajax.googleapis.com http://ajax.aspnetcdn.com").
  </code></pre>
  
  <p>When I add <code>www.gstatic.com</code> I get the following error:</p>
  
  <pre><code>Content Security Policy: The page's settings blocked the loading of a resource at https://www.google.com/recaptcha/api2/anchor?k=6LdHZB4TAAAAAMj_6F7h1ahYTNAjtHqRvWLj_FBx&amp;co=aHR0cDovL3Rhc2tnZW5lcmF0b3IubG9jYWxob3N0Ojgw&amp;hl=en&amp;v=r20160913151359&amp;size=normal&amp;cb=lvhf93b5gk4z ("default-src 'none'").
  </code></pre>
  
  <p>despite having already whitelisted <code>www.google.com</code> as per above.</p>
  
  <p>This is happening all the way down the &amp;#$!%(@ rabbit hole. There doesn’t seem to be an end to it. All I want is to add a stupid ReCaptcha to the site -- how hard should that be??</p>
  
  <p>I am being seriously convinced to gratuitously tear the HTML5 boilerplate from the project and go it raw/custom/default just to avoid these intractable show-stopping critical bugs.</p>
  
  <p>Please tell me:</p>
  
  <ol>
  <li>How to turn <strong>OFF</strong> CSP from within the HTML5 Boilerplate, or</li>
  <li>How to correct this issue for a feature that <em>should</em> already be whitelisted (Google API).</li>
  </ol>
  
  <p>The <a href="http://rehansaeed.com/asp-net-mvc-boilerplate/" rel="nofollow">HTML5 MVC Boilerplate page</a> <a href="http://rehansaeed.com/content-security-policy-for-asp-net-mvc/" rel="nofollow">provides ZERO advice</a> in this regard.</p>
  
  <hr>
  
  <p>EDIT:</p>
  
  <p>The code within my <code>FilterConfig.cs</code> was originally as such:</p>
  
  <pre><code>filters.Add(
    new CspScriptSrcAttribute() {
      CustomSources = string.Join(
        " ",
  #if DEBUG
        "localhost:*",
  #endif
        ContentDeliveryNetwork.Google.Domain,
        ContentDeliveryNetwork.Microsoft.Domain
      ),
      Self = true,
    });
  </code></pre>
  
  <p>With the constants (<code>contentdeliverynetwork.cs</code>) as such:</p>
  
  <pre><code>public static class ContentDeliveryNetwork {
    public static class Google {
      public const string Domain = "ajax.googleapis.com";
      public const string JQueryUrl = "//ajax.googleapis.com/ajax/libs/jquery/2.2.3/jquery.min.js";
    }
    public static class MaxCdn {
      public const string Domain = "maxcdn.bootstrapcdn.com";
      public const string FontAwesomeUrl = "//maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css";
    }
    public static class Microsoft {
      public const string Domain = "ajax.aspnetcdn.com";
      public const string JQueryValidateUrl = "//ajax.aspnetcdn.com/ajax/jquery.validate/1.15.0/jquery.validate.min.js";
      public const string JQueryValidateUnobtrusiveUrl = "//ajax.aspnetcdn.com/ajax/mvc/5.2.3/jquery.validate.unobtrusive.min.js";
      public const string ModernizrUrl = "//ajax.aspnetcdn.com/ajax/modernizr/modernizr-2.8.3.js";
      public const string BootstrapUrl = "//ajax.aspnetcdn.com/ajax/bootstrap/3.3.6/bootstrap.min.js";
    }
  }
  </code></pre>
  
  <p>And even a modification to the following:</p>
  
  <pre><code>filters.Add(
    new CspScriptSrcAttribute() {
      CustomSources = string.Format("google.com www.gstatic.com www.google.com localhost:* ajax.googleapis.com ajax.aspnetcdn.com"),
      Self = true,
    });
  </code></pre>
  
  <p>does not help.</p>