Content Security Policy in ASP.NET Core Without the appsettings Hack
Your strict Content Security Policy breaks the moment one ASP.NET Core route serves HTML — Scalar, an admin page, a Keycloak iframe. The usual band-aid weakens every other endpoint. Granit’s per-endpoint CSP composition keeps strict defaults strict and lets the package that mounts the UI declare its own relaxation.