Azure SignalR Service - Response Headers (How do I add/modify them?)

Hi @Ken Wee
Thanks for the question and using MS Q&A platform.

Adding a Content Security Policy (CSP) header to the Azure SignalR Service endpoint, it's important to note that Azure SignalR Service does not allow you to directly modify the response headers for its endpoints, including adding CSP headers. However, there are alternative approaches you can consider implementing CSP in your application.
 Implementing CSP in Your Application

If your application is hosted on Azure App Service or any other web server, you can add CSP headers at the application level. Here’s how you can do it in an ASP.NET Core application:

Middleware Approach

You can create middleware to add the CSP header to all responses from your application. Here’s a simple example:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
   app.Use(async (ctx, next) =>
   {
       ctx.Response.Headers.Add("Content-Security-Policy", "default-src 'self';");
       await next();
   });
 
   // Other middleware registrations
   app.UseRouting();
   app.UseEndpoints(endpoints =>
   {
       endpoints.MapHub<YourHub>("/yourhub");
   });
}

Using Azure Front Door or Application Gateway

If you're using Azure Front Door or Application Gateway in front of your SignalR service, you can configure these services to add headers to responses. This would allow you to set a CSP header for requests routed through these services.

Web Server Configuration

If your application is running on a web server (like IIS), you can also configure the server to add CSP headers. For example, in IIS, you can add custom headers through the web.config file:

<configuration>
 <system.webServer>
   <httpProtocol>
     <customHeaders>
       <add name="Content-Security-Policy" value="default-src 'self';" />
     </customHeaders>
   </httpProtocol>
 </system.webServer>
</configuration>

Considerations for SignalR

While you cannot modify the headers sent by the Azure SignalR Service directly, ensure that your application that interacts with SignalR has appropriate CSP settings. This includes ensuring that any scripts or resources loaded from the SignalR service comply with your CSP.

I hope this information is helpful

Hi @Ken Wee
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Hi @Ken Wee
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Hi I've upvoted your suggestion since it is a good way to approach it.

Using Azure Front Door was not feasible as this would add cost to the build.

As for the web server side config, this only worked when not using self hosted signalr hub. Did not work for Azure SignalR Service as the endpoint was managed by Azure.

I was able to get feedback from MS Support Engineer, and they did mention that adding response headers directly to the Azure SignalR Service endpoint was not possible as of today.