Issues with implementation of Content security policy header in ASP.NET Web Forms application.

Question

Hi Team, We are facing below five issues while adding CSP header in Asp.Net Web Forms application. Please guide to fix these issue with minimum changes.

1. Application is not able to execute inline scripts after adding CSP to web.config file. Example: <script type="text/javascript"> var applicationdomain; function initLoad() { document.body.style.display="none"; if( top.document.domain == applicationdomain ) { document.body.style.display=""; } else { top.location = self.location; } } </script> Currently, we have more than 100 inline scripts tags which are not working.
2. Apart from these, Asp.Net auto injects some scripts at runtime to handle post back and other events. These scripts are also blocked by CSP. Example: <script type="text/javascript"> //<![CDATA[ var theForm = document.forms['aspnetForm']; if (!theForm) { theForm = document.aspnetForm; } function __doPostBack(eventTarget, eventArgument) { if (!theForm.onsubmit || (theForm.onsubmit() != false)) { theForm.__EVENTTARGET.value = eventTarget; theForm.__EVENTARGUMENT.value = eventArgument; theForm.submit(); } } //]]> </script>
3. Inline events are blocked by CSP. Example: <a id="ctl00_LoginStatus1" onclick="closePops(&#39;cf0a3db0-7af3-42a5-87cd-23f12617d258');" class="logout" href="javascript:__doPostBack('ctl00$LoginStatus1$ctl00','')">Logout</a>
4. Inline styles are also blocked by CSP. <div id="ctl00_MessageSummary" class="ErrorValidationMessage" style="color:Red;width:100%;display:none;"> </div> <div id="ctl00_ValidationSummary1" class="ErrorValidationMessage" style="color:Red;width:100%;display:none;"> </div> <div id="ctl00_ValidationSummary2" class="ErrorValidationMessage" style="color:Red;width:100%;display:none;"> Currently, we have more than 1000 inline style elements in our application
5. CSP also blocking execution of WebResource.axd file. Example: We are using custom control in our application: [assembly: WebResource("Common.Javascript.MultiLine.js", "application/x-javascript")] namespace Internet.CM { [DefaultProperty("Text")] [ToolboxData("<{0}:MultiLine runat=server></{0}:MultiLine>")] public class MultiLine : TextBox { [Bindable(true)] [Category("Appearance")] [DefaultValue("")] [Localizable(true)]