Application publishing prepares application artifacts for a target environment and may deploy them automatically. In Visual Studio, a publish profile stores the release and deployment settings for a selected target. section 12.4.1
Choose a publishing approach according to the hosting environment and deployment requirements:
- Use an integrated publish-and-deploy target when the server supports the required deployment module, package, or service. section 12.4.1
- Use a folder target to create local artifacts, then deploy them separately through another technique. section 12.4.1
- For Windows hosting with Web Deploy installed, select a compatible Visual Studio target; Linux hosting typically uses a local folder or FTP server. section 12.4.1
Verify a published web API
After publishing, confirm the Publish Succeeded message and open the deployed site. A root-level HTTP 400 error can be normal when production disables Swagger UI. Test working GET endpoints such as /error/test and /cod/test instead. If /cod/test displays a blank page, inspect the browser developer console: a Content Security Policy may have blocked its inline script. A narrowly scoped nonce can permit that specific script without broadly enabling inline execution. section 12.4.4
Refused to execute inline script because it violates the following Content Security Policy directive: "default-src ' self' ". Either the ‘unsafe-inline’ keyword, a hash (‘sha256-j3kW1ylRRXx1+pINyR/6EW435UHoxKSlU6fhd5xVSSk=‘), or a nonce (' nonce-...' ) is required to enable inline execution. Note also that ' script-src' was not explicitly set, so ' default-src' is used as a fallback.
Use the browser console's policy violation to diagnose why a published endpoint's inline script was refused. section 12.4.4
