webresource.axd scriptresource.axd files

Joseph Reeta Mary (NCS) 0

need some documentation on webresource.axd and scriptresource.axd files are generated by asp.net runtime handlers. We need to confirm that as we can't implement CSP (apply nonce)

Lan Huang-MSFT 26,761 Reputation points Microsoft Vendor

2023-02-14T09:29:51.7066667+00:00

Hi @Joseph Reeta Mary (NCS),

need some documentation on webresource.axd and scriptresource.axd files are generated by asp.net runtime handlers.

WebResource.axd and ScriptResource.axd are basically HTTP handlers in .NET Framework implementing IHttpHandler interface. Purpose of these HTTP handlers is to get the embedded resources inside an assembly.

You can check out this post and this post for detailed instructions on webresource.axd scriptresource.axd files.

We need to confirm that as we can't implement CSP (apply nonce)

If you need to allow inline scripts and styles, you can specify "unsafe inline", a random number source or a hash source that matches the inline block.

Content-Security-Policy: script-src 'unsafe-inline';

You can also obtain the hash value through the browser to implement CSP.

Content-Security-Policy: script-src 'self' 'sha256-2NqnatcPqy5jjBXalTpZyJMO/0fUaYUb3ePlviUP4II=' 'unsafe-eval';

Content-Security-Policy in ASP.NET WebForms

Best regards,
Lan Huang
Joseph Reeta Mary (NCS) 0 Reputation points

2023-02-14T15:13:29.7566667+00:00

Thanks Lim for the update. But unable to apply "nonce" on webresource.axd/scriptresource.axd files as it is flagged out by tester. Also not able to remove "unsafe-inline"
Joseph Reeta Mary (NCS) 0 Reputation points

2023-02-15T01:26:52.2733333+00:00

Thanks for the update. but unable to apply "nonce" on webresource.axd and scriptresource.axd files.

Aslo can't remove 'unsafe-inline'
Lan Huang-MSFT 26,761 Reputation points Microsoft Vendor

2023-02-15T05:11:42.61+00:00

Hi @Joseph Reeta Mary (NCS),

unable to apply "nonce" on webresource.axd and scriptresource.axd files.

What does Unable to apply "nonce" on webresource.axd and scriptresource.axd files mean? What problem are you currently facing? What efforts have you made?

Aslo can't remove 'unsafe-inline'

What does 'unsafe-inline' cannot be removed mean? I don't seem to have mentioned the need to remove "unsafe-inline" earlier.

1 answer

SurferOnWww 2,081 Reputation points

2023-02-15T00:55:42.1766667+00:00

I do not understand what you mean by "unable to apply "nonce" on webresource.axd and scriptresource.axd files."

Anyway, you will be able to configure your ASP.NET Web Forms application not to use the webresource.axd and scriptresource.axd if you use .NET framework 4.5 or higher as the target framework.

See the following document for details:

ASP.NET 4.5 ScriptManager Improvements in WebForms
Please sign in to rate this answer.
do you like msr best nuts in your moth 0 Reputation points

2023-09-01T15:38:27.71+00:00

hi
Sign in to comment

Share via

webresource.axd scriptresource.axd files

1 answer