ASP.NET MVC HTML5 Boilerplate - Content Security Policy is killing all external scripts, even “whitelisted” ones
<p>Current Project:</p>

<ul>
<li>ASP.NET 4.5.2</li>
<li>MVC 5</li>
<li>HTML5 Boilerplate</li>
<li>Google ReCaptcha (any NuGet package, take your pick, I’ve already churned through three of them)</li>
</ul>

<p>So it appears that anything from outside the <a href="http://www.taskgenerator.ca/demo/" rel="nofollow">site I am developing</a> gets stopped, <em>cold</em>, by the Content Security Policy. Yes, there is supposed to be a Google ReCaptcha at the bottom of that form. Don’t see it? Yeah… This is <em>despite</em> things like <code>ajax.googleapis.com</code> being supposedly “whitelisted” through <code>FilterConfig.cs</code>.</p>

<p>When I go to my site and try to load it, I get the console error:</p>

<pre><code>Content Security Policy: The page's settings blocked the loading of a resource at https://www.google.com/recaptcha/api.js ("script-src http://http://www.taskgenerator.ca http://localhost:* http://ajax.googleapis.com http://ajax.aspnetcdn.com").
</code></pre>

<p>When I add <code>www.google.com</code> to the <code>CspScriptSrcAttribute()</code> inside <code>FilterConfig.cs</code>, I get the following error:</p>

<pre><code>Content Security Policy: The page's settings blocked the loading of a resource at https://www.gstatic.com/recaptcha/api2/r20160913151359/recaptcha__en.js ("script-src http://http://www.taskgenerator.ca http://localhost:* http://www.google.com http://ajax.googleapis.com http://ajax.aspnetcdn.com").
</code></pre>

<p>When I add <code>www.gstatic.com</code> I get the following error:</p>

<pre><code>Content Security Policy: The page's settings blocked the loading of a resource at https://www.google.com/recaptcha/api2/anchor?k=6LdHZB4TAAAAAMj_6F7h1ahYTNAjtHqRvWLj_FBx&amp;co=aHR0cDovL3Rhc2tnZW5lcmF0b3IubG9jYWxob3N0Ojgw&amp;hl=en&amp;v=r20160913151359&amp;size=normal&amp;cb=lvhf93b5gk4z ("default-src 'none'").
</code></pre>

<p>despite having already whitelisted <code>www.google.com</code> as per above.</p>

<p>This is happening all the way down the &amp;#$!%(@ rabbit hole. There doesn’t seem to be an end to it. All I want is to add a stupid ReCaptcha to the site -- how hard should that be??</p>

<p>I am being seriously convinced to gratuitously tear the HTML5 boilerplate from the project and go it raw/custom/default just to avoid these intractable show-stopping critical bugs.</p>

<p>Please tell me:</p>

<ol>
<li>How to turn <strong>OFF</strong> CSP from within the HTML5 Boilerplate, or</li>
<li>How to correct this issue for a feature that <em>should</em> already be whitelisted (Google API).</li>
</ol>

<p>The <a href="http://rehansaeed.com/asp-net-mvc-boilerplate/" rel="nofollow">HTML5 MVC Boilerplate page</a> <a href="http://rehansaeed.com/content-security-policy-for-asp-net-mvc/" rel="nofollow">provides ZERO advice</a> in this regard.</p>

<hr>

<p>EDIT:</p>

<p>The code within my <code>FilterConfig.cs</code> was originally as such:</p>

<pre><code>filters.Add(
  new CspScriptSrcAttribute() {
    CustomSources = string.Join(
      " ",
#if DEBUG
      "localhost:*",
#endif
      ContentDeliveryNetwork.Google.Domain,
      ContentDeliveryNetwork.Microsoft.Domain
    ),
    Self = true,
  });
</code></pre>

<p>With the constants (<code>contentdeliverynetwork.cs</code>) as such:</p>

<pre><code>public static class ContentDeliveryNetwork {
  public static class Google {
    public const string Domain = "ajax.googleapis.com";
    public const string JQueryUrl = "//ajax.googleapis.com/ajax/libs/jquery/2.2.3/jquery.min.js";
  }
  public static class MaxCdn {
    public const string Domain = "maxcdn.bootstrapcdn.com";
    public const string FontAwesomeUrl = "//maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css";
  }
  public static class Microsoft {
    public const string Domain = "ajax.aspnetcdn.com";
    public const string JQueryValidateUrl = "//ajax.aspnetcdn.com/ajax/jquery.validate/1.15.0/jquery.validate.min.js";
    public const string JQueryValidateUnobtrusiveUrl = "//ajax.aspnetcdn.com/ajax/mvc/5.2.3/jquery.validate.unobtrusive.min.js";
    public const string ModernizrUrl = "//ajax.aspnetcdn.com/ajax/modernizr/modernizr-2.8.3.js";
    public const string BootstrapUrl = "//ajax.aspnetcdn.com/ajax/bootstrap/3.3.6/bootstrap.min.js";
  }
}
</code></pre>

<p>And even a modification to the following:</p>

<pre><code>filters.Add(
  new CspScriptSrcAttribute() {
    CustomSources = string.Format("google.com www.gstatic.com www.google.com localhost:* ajax.googleapis.com ajax.aspnetcdn.com"),
    Self = true,
  });
</code></pre>

<p>does not help.</p>