This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 55.00000000000001%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJR%3C/text%3E%3C/svg%3E)
need some documentation on webresource.axd and scriptresource.axd files are generated by asp.net runtime handlers. We need to confirm that as we can't implement CSP (apply nonce)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 36%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELH%3C/text%3E%3C/svg%3E)
need some documentation on webresource.axd and scriptresource.axd files are generated by asp.net runtime handlers.
WebResource.axd and ScriptResource.axd are basically HTTP handlers in .NET Framework implementing IHttpHandler interface. Purpose of these HTTP handlers is to get the embedded resources inside an assembly.
You can check out this post and this post for detailed instructions on webresource.axd scriptresource.axd files.
We need to confirm that as we can't implement CSP (apply nonce)
If you need to allow inline scripts and styles, you can specify "unsafe inline", a random number source or a hash source that matches the inline block.
Content-Security-Policy: script-src 'unsafe-inline';
You can also obtain the hash value through the browser to implement CSP.
Content-Security-Policy: script-src 'self' 'sha256-2NqnatcPqy5jjBXalTpZyJMO/0fUaYUb3ePlviUP4II=' 'unsafe-eval';
Content-Security-Policy in ASP.NET WebForms
Best regards,
Lan Huang
Thanks Lim for the update. But unable to apply "nonce" on webresource.axd/scriptresource.axd files as it is flagged out by tester. Also not able to remove "unsafe-inline"
Thanks for the update. but unable to apply "nonce" on webresource.axd and scriptresource.axd files.
Aslo can't remove 'unsafe-inline'
unable to apply "nonce" on webresource.axd and scriptresource.axd files.
What does Unable to apply "nonce" on webresource.axd and scriptresource.axd files mean? What problem are you currently facing? What efforts have you made?
Aslo can't remove 'unsafe-inline'
What does 'unsafe-inline' cannot be removed mean? I don't seem to have mentioned the need to remove "unsafe-inline" earlier.
I do not understand what you mean by "unable to apply "nonce" on webresource.axd and scriptresource.axd files."
Anyway, you will be able to configure your ASP.NET Web Forms application not to use the webresource.axd and scriptresource.axd if you use .NET framework 4.5 or higher as the target framework.
See the following document for details:
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 20%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDY%3C/text%3E%3C/svg%3E)
hi