ASP.NET Web Forms loads legacy jQuery 1.12.4 via ScriptResource.axd instead of jQuery 3.7.1 and is flagged in security scan

Question

Hello,

I am working on an ASP.NET Web Forms application where I have explicitly included jQuery version 3.7.1 in the project and pages. However, when the application runs and I inspect the network requests, I see that ScriptResource.axd is loading jQuery version 1.12.4.

Example request:

/ScriptResource.axd?d=MZxpc6JdZbbtFUlWr-Yp62Ef_7Zpw4WdN5E9uX6xkEs-U-u86e41aulYfFjXgQW4J7u4oHKFO5tgWAjesf12BTB976GkcsesxSBv9OKBOQ5UfmSYKcpdQkr3we3YowULPf8qC80knoWIxyeqkjMrgTRU5WE1&t=78d79713

Questions ;-

1)Why does ScriptResource.axd serve jQuery 1.12.4 even when a newer version (3.7.1) is already included?

2)Why does this issue occur only for a specific request URL/page and not the entire application?

3)Is this behavior caused by ScriptManager’s default script registration, ScriptResourceDefinition, or a third-party ASP.NET control?

4)How can I override or disable the legacy jQuery being injected by ScriptResource.axd?

5)What is the recommended and secure way to ensure only jQuery 3.7.1 is used so that the security scan does not flag this issue?

Any guidance on configuring ScriptManager, Web.config, or correctly replacing the default ASP.NET AJAX jQuery reference would be greatly appreciated.

Answer 1

1. Why does ScriptResource.axd serve jQuery 1.12.4 even when a newer version (3.7.1) is already included?
   The ScriptResource.axd serves jQuery 1.12.4 because it is likely being referenced by the ASP.NET AJAX framework or a control that relies on it. The ASP.NET framework may have a default setting that uses this version unless explicitly overridden.
2. Why does this issue occur only for a specific request URL/page and not the entire application?
   This behavior may occur due to specific controls or scripts on that particular page that are designed to use the default version of jQuery provided by the ASP.NET framework. If those controls are not present on other pages, the newer jQuery version might be loaded correctly.
3. Is this behavior caused by ScriptManager’s default script registration, ScriptResourceDefinition, or a third-party ASP.NET control?
   Yes, this behavior is typically caused by the ScriptManager's default script registration, which may include references to legacy versions of jQuery. Additionally, third-party controls that depend on ASP.NET AJAX might also be contributing to this issue.
4. How can I override or disable the legacy jQuery being injected by ScriptResource.axd?
   To override or disable the legacy jQuery, you can set the EnableCdn property of the ScriptManager to true and ensure that you register your version of jQuery after the ScriptManager is initialized. You can also remove the default script registration if possible.
5. What is the recommended and secure way to ensure only jQuery 3.7.1 is used so that the security scan does not flag this issue?
   The recommended way is to explicitly include jQuery 3.7.1 in your pages using a <script> tag that points to the CDN or a local copy. Additionally, ensure that you do not have any controls or scripts that automatically reference the older version. You can also check your Web.config for any settings that might be enforcing the use of the older jQuery version.

For detailed configuration, you may need to review the ScriptManager settings and potentially modify any third-party controls that are causing the legacy version to load.

Answer 2

Any guidance on configuring ScriptManager, Web.config, or correctly replacing the default ASP.NET AJAX jQuery reference would be greatly appreciated.

Although I do not know why your ScriptResource.axd is loading jQuery v1.12.4 in your app, if you do not use the script mapping to the ScriptManager I suggest you consider use of the script mapping.

Starting with ASP.NET 4.5, for server controls that use client scripts to function correctly, it is recommended to register the necessary client scripts with ScriptManager and deploy ScriptManager on all pages.

When you create the ASP.NET Web Forms app in the Web Application Project format using the template of Visual Studio, the script files for Microsoft Ajax and WebForms are stored in the application's Scripts folder and downloaded from there via ScriptManager. (Previously, they were downloaded from the server control's resources using handlers called WebResource.axd and ScriptResource.axd.)

Furthermore, in addition to Microsoft Ajax and WebForms scripts, scripts such as jQuery and Bootstrap can be integrated with ScriptManager.

For more details, please see the MSDN Blog article ASP.NET 4.5 ScriptManager Improvements in WebForms.

Below is the BundleConfig.cs and ScriptManager of the project created when the template of ASP.NET Web Forms project in the Visual Studio 2026 is used:

BundleConfig.cs in App_Start folder

Note that jQuery is upgraded to v3.7.1 (default is v3.7.0).

using System.Web.Optimization;
using System.Web.UI;

namespace WebForms1
{
    public class BundleConfig
    {
        public static void RegisterBundles(BundleCollection bundles)
        {
            RegisterJQueryScriptManager();

            bundles.Add(new ScriptBundle("~/bundles/WebFormsJs").Include(
                            "~/Scripts/WebForms/WebForms.js",
                            "~/Scripts/WebForms/WebUIValidation.js",
                            "~/Scripts/WebForms/MenuStandards.js",
                            "~/Scripts/WebForms/Focus.js",
                            "~/Scripts/WebForms/GridView.js",
                            "~/Scripts/WebForms/DetailsView.js",
                            "~/Scripts/WebForms/TreeView.js",
                            "~/Scripts/WebForms/WebParts.js"));

            bundles.Add(new ScriptBundle("~/bundles/MsAjaxJs").Include(
                    "~/Scripts/WebForms/MsAjax/MicrosoftAjax.js",
                    "~/Scripts/WebForms/MsAjax/MicrosoftAjaxApplicationServices.js",
                    "~/Scripts/WebForms/MsAjax/MicrosoftAjaxTimer.js",
                    "~/Scripts/WebForms/MsAjax/MicrosoftAjaxWebForms.js"));

            bundles.Add(new ScriptBundle("~/bundles/modernizr").Include(
                            "~/Scripts/modernizr-*"));
        }

        public static void RegisterJQueryScriptManager()
        {
            ScriptManager.ScriptResourceMapping.AddDefinition("jquery",
                new ScriptResourceDefinition
                {
                    Path = "~/scripts/jquery-3.7.1.min.js",
                    DebugPath = "~/scripts/jquery-3.7.1.js",
                    CdnPath = "https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.7.1.min.js",
                    CdnDebugPath = "https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.7.1.js"
                });
        }
    }
}

ScriptManager in Site.Master

<asp:ScriptManager runat="server">
    <Scripts>
        <%--To learn more about bundling scripts in ScriptManager see https://go.microsoft.com/fwlink/?LinkID=301884 --%>
        <%--Framework Scripts--%>
        <asp:ScriptReference Name="MsAjaxBundle" />
        <asp:ScriptReference Name="jquery" />
        <asp:ScriptReference Name="WebForms.js" Assembly="System.Web" Path="~/Scripts/WebForms/WebForms.js" />
        <asp:ScriptReference Name="WebUIValidation.js" Assembly="System.Web" Path="~/Scripts/WebForms/WebUIValidation.js" />
        <asp:ScriptReference Name="MenuStandards.js" Assembly="System.Web" Path="~/Scripts/WebForms/MenuStandards.js" />
        <asp:ScriptReference Name="GridView.js" Assembly="System.Web" Path="~/Scripts/WebForms/GridView.js" />
        <asp:ScriptReference Name="DetailsView.js" Assembly="System.Web" Path="~/Scripts/WebForms/DetailsView.js" />
        <asp:ScriptReference Name="TreeView.js" Assembly="System.Web" Path="~/Scripts/WebForms/TreeView.js" />
        <asp:ScriptReference Name="WebParts.js" Assembly="System.Web" Path="~/Scripts/WebForms/WebParts.js" />
        <asp:ScriptReference Name="Focus.js" Assembly="System.Web" Path="~/Scripts/WebForms/Focus.js" />
        <asp:ScriptReference Name="WebFormsBundle" />
        <%--Site Scripts--%>
    </Scripts>
</asp:ScriptManager>

The resultant html source:

<script src="/bundles/MsAjaxJs?v=D6VN0fHlwFSIWjbVzi6mZyE9Ls-4LNrSSYVGRU46XF81" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
if (typeof(Sys) === 'undefined') throw new Error('ASP.NET Ajax crient framework not loaded');
//]]>
</script>

<script src="scripts/jquery-3.7.1.js" type="text/javascript"></script>
<script src="/bundles/WebFormsJs?v=N8tymL9KraMLGAMFuPycfH3pXe6uUlRXdhtYv8A_jUU1" type="text/javascript"></script>