title: How to whitelist dynamically created scripts in a WebForms project using CSP (Content Security Policy)?
body: <p>Is there a secure way of whitelisting dynamically created scripts in a WebForms project using CSP (Content Security Policy)?</p>
  
  <p>Using <code>unsafe-inline</code> like below it works but not recommended.</p>
  
  <pre><code>context.Response.Headers.Append("Content-Security-Policy", string.Format("default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' data: https:; style-src 'self'; script-src 'self' 'unsafe-inline'"));
  </code></pre>
  
  <p>For any other options such as <code>nonce-(random)</code>, we see this CSP error message:</p>
  
  <blockquote>
    <p>Refused to execute inline script because it violates the following
    Content Security Policy directive: "script-src 'self'". Either the
    'unsafe-inline' keyword, a hash, or a nonce is required to enable
    inline execution.</p>
  </blockquote>
  
  <p><a href="https://i.stack.imgur.com/OVSXW.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/OVSXW.jpg" alt="enter image description here"></a></p>