"In my ASP.NET MVC 5 project, I am migrating to a strict Content Security Policy (CSP) to eliminate the use of 'unsafe-inline' for scripts. While I have successfully implemented the Nonce approach to secure my initial page loads, I still have two outstand

Question

"In my ASP.NET MVC 5 project, I am migrating to a strict Content Security Policy (CSP) to eliminate the use of 'unsafe-inline' for scripts. While I have successfully implemented the Nonce approach to secure my initial page loads, I still have two outstand

Priyanshi Vasoya 0

"In my ASP.NET MVC 5 project, I am migrating to a strict Content Security Policy (CSP) to eliminate the use of 'unsafe-inline' for scripts. While I have successfully implemented the Nonce approach to secure my initial page loads, I still have two outstanding issues:

I need to migrate several existing inline JavaScript functions and handlers without losing their functionality.

I cannot apply the Nonce to scripts dynamically injected by Kendo UI's deferred script loading mechanism, resulting in CSP violations.

How can I securely refactor these inline functions and integrate a solution (like hashing or configuration) to satisfy the CSP for the Kendo deferred scripts?"

Priyanshi Vasoya 0 Reputation points

2025-12-05T09:47:56.86+00:00

Given the scale of my large project and the presence of numerous varied inline JavaScript functions and event handlers, is it possible to achieve Content Security Policy (CSP) compliance (i.e., remove 'unsafe-inline') without migrating every single inline script block to an external .js file?
Danny Nguyen (WICLOUD CORPORATION) 5,065 Reputation points Microsoft External Staff Moderator

2025-12-05T11:04:59.6033333+00:00

Hi I've recieved this post. I'll try to answer it as fast as I can next week.

1 answer

Your answer

Priyanshi Vasoya 0 Reputation points

2025-12-05T09:47:56.86+00:00

Given the scale of my large project and the presence of numerous varied inline JavaScript functions and event handlers, is it possible to achieve Content Security Policy (CSP) compliance (i.e., remove 'unsafe-inline') without migrating every single inline script block to an external .js file?
Danny Nguyen (WICLOUD CORPORATION) 5,065 Reputation points Microsoft External Staff Moderator

2025-12-05T11:04:59.6033333+00:00

Hi I've recieved this post. I'll try to answer it as fast as I can next week.

Answer 1

Bruce (SqlWork.com) 81,971 Volunteer Moderator

yes, all inline scripts must be replaced with external scripts. Kendo ui has added support for CSP

https://www.telerik.com/kendo-jquery-ui/documentation/intro/widget-basics/content-security-policy

Share via

"In my ASP.NET MVC 5 project, I am migrating to a strict Content Security Policy (CSP) to eliminate the use of 'unsafe-inline' for scripts. While I have successfully implemented the Nonce approach to secure my initial page loads, I still have two outstand

1 answer

Your answer