Deployment puts a web API on a server where other people can access it. A project being ready to ship does not itself mean it has been released: shipping is a separate decision. For the board-game API, the immediate goal is to let product owners and testers reach and evaluate the first release. section 12.0
Publishing creates the files to deploy, including framework libraries, project binaries, and static content. Before publishing, choose a .NET publishing mode by weighing the available options. A Visual Studio Windows publishing profile can then publish and deploy the API to a production Windows Server. section 12.4
Check the deployed API rather than assuming a successful publish means every page will behave as it did locally:
- Confirm that publishing succeeded and open the site. An error at the site root is not necessarily a failed deployment: the development startup page used Swagger UI, which is disabled in production for security. section 12.4.4
- Request /error/test in a browser. It should return the API’s JSON error response. section 12.4.4
- Request /cod/test. If its expected JavaScript alert does not appear, inspect the browser developer console. The configured Content-Security-Policy blocks the inline script; the console message identifies the restriction. section 12.4.4
Refused to execute inline script because it violates the following Content Security Policy directive: "default-src ' self' ". Either the ‘unsafe-inline’ keyword, a hash (‘sha256-j3kW1ylRRXx1+pINyR/6EW435UHoxKSlU6fhd5xVSSk=‘), or a nonce (' nonce-...' ) is required to enable inline execution. Note also that ' script-src' was not explicitly set, so ' default-src' is used as a fallback.
The browser’s refusal message shows why a deployed endpoint can load without running its inline script: the content security policy requires an allowed script source, hash, or nonce. section 12.4.4
To permit that particular script, update the Content-Security-Policy header in Program.cs with a script nonce and give the script the matching nonce, then republish and redeploy. Treat this as a deliberate security-policy change, not as proof that the original deployment failed. section 12.4.4
The Windows Server target is one deployment choice. ASP.NET Core can also target Linux, Docker, or another publishing destination with minor process differences. Deployment work often belongs to deployment engineers or system administrators, but it is also useful for full-stack and small DevOps-oriented teams. section 12.0
