title: Content-Security-Policy in ASP.NET WebForms
body: <p>I'm looking for a good way to implement a relatively strong <code>Content-Security-Policy</code> header for my ASP.NET WebForms application. I'm storing as much JavaScript as possible in files instead of inline, but by default, WebForms injects <em>a lot</em> of inline scripts—for things as simple as form submission and basic AJAX calls.</p>
  <p>MVC has some simple ways to implement nonces, especially with the help of third party libraries like NWebsec, but I can't seem to find any methods of implementing them with WebForms. I wouldn't even have a problem using hashes if there were a way to predict and retrieve the hash for each .NET injected script tag.</p>
  <p>I hate allowing the <code>'unsafe-inline'</code> value. It feels wrong needing to turn off such a powerful security feature. Is there a reasonable way to implement it in WebForms?</p>