Add a tag helper to automatically put SHA hash into CSP - alternative to nonce

[shand-obs]

It would be great if any inline script tag could be annotate with an attribute something like "asp-csp-hash". This could be implemented as a tag helper that automatically calculates the SHA hash of the script contents and adds to the CSP response header.

I don't know if it's too late to update the response header by this point in the middleware. I was thinking it could be done when the middleware stack unwinds if the response hasn't been sent yet.

[juunas11]

Yeah, it might be :) I'm not really sure how you'd implement that though since you'd have to somehow resolve the script content about to be sent, calculate the hash, and add it.

[iamrahul127]

I am not expert but look like https://github.com/jrestall/BasicMiddleware/tree/jrestall/csp/src/Microsoft.AspNetCore.Mvc.Csp might help. Please check TagHelper folder.