title: How to implement strict CSP for System.Web.UI.HTMLControls HTMLForm?
body: <p>I'm having some issues adding a proper CSP to a legacy application.</p>
  <p>Originally, I was having issue fixing all the inline events that were being added by the HTMLControls as the I do not want the policy to allow those. I managed to address this by creating a custom HTMLTextWriter to handle Onclick and OnChange events and binding them to the proper handlers using element.AddEventListener.</p>
  <p>Now, the issue arises where an HTMLForm seems to be receiving an onsubmit with value of &quot;javascript:return WebForm_OnSubmit();&quot;.</p>
  <pre><code>&lt;form method=&quot;post&quot; action=&quot;./MyPage.aspx&quot; onsubmit=&quot;javascript:return WebForm_OnSubmit();&quot; id=&quot;form1&quot;&gt;
  ...
  &lt;/form&gt;
  </code></pre>
  <p>This is caused by some custom validators in the legacy app.
  My issue is, that the custom html text writer doesn't seem to be able to see the form being written at all. The only parts that are available are the form id.</p>
  <p>Things I've noticed:</p>
  <ol>
  <li>The form is automatically generated, it was added to a master file and the designer section is automatically updated.</li>
  <li>The code behind only has a couple of properties for culture code information and location of a style bundle and a method to set the href attribute of the styles to the location of the style bundle.</li>
  </ol>
  <p>How do I remove additional event handlers from asp.net WebForms in order to create a CSP compliant application?</p>