1

We have been asked to implement Content-Security-Policy to mitigate XSS attacks on our App. As result we need to move all inline scripts to referenced files, which could then be specified as safe in the Content-Security-Policy HTTP headers.

This has mostly been doable, however it now seems that some webcontrols ie webforms inject inline scripts to do callbacks.

Is there a way around this or do we need to use 3rd party controls or possibly create custom controls?

ADyson
  • 57,178
  • 14
  • 51
  • 63
cmdln
  • 77
  • 2
  • 8

1 Answers1

1

There are 2 technologies for developing web applications in ASP.NET:

  1. ASP.NET MVC makes a separation between the user interface and the code (application logic and presentation logic). It has full control over the generated HTML code, generates pure HTML code, so you can use 'nonce-value' to allow inline scripts '' and inline styles <style>.

  2. ASP.NET WebForms has a user interface logic that is closely related to the code, and it is difficult to separate it from it, so scripts and styles are uncontrollably embedded in the generated HTML code.
    When using the WebForms, you can use '<hash-algorithm>-<base64-value>', but the hash values will depend on the deployment environment. Nonces are not applicable directly, but you can use a trick - to override the __doPostBack or HtmlTextWriter methods - please see details here.

granty
  • 7,234
  • 1
  • 14
  • 21
  • There are too many pages in our projects to convert to MVC (Approx 1500). It's not an option convert everything. Do you know of any 3rd party web controls that may resolve the inline script issue? – cmdln Aug 25 '21 at 14:30
  • Yeah, it's a lot of job! Start wit more important project, Run CSP in Report-Only mode and use NWebsec 2.0.0 which have a built-in CSP report handler. So you can easily find all violations. After evaluating the scope of work on the implementation of nonce, you will make a decision on upgrading the remaining projects. I do not think there is a third party service to do all job. – granty Aug 25 '21 at 15:54