600196f679
aspnetcore-browser-refresh.js uses plain ws:// (not wss://) so it was blocked by the CSP which only listed wss://localhost:*. Both are needed in dev: ws:// for the dotnet watch browser refresh socket, wss:// for SignalR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>