displays the results for the classic ASP.net site I am currently working on:
object-src 'none'; img-src 'self'; script-src 'self'; require-trusted-types-for 'script'Despite these settings, the code using __DoPostback JS does not seem to be functioning properly. Here is a snippet from the web.config file:
<rule name="CSP"> <match serverVariable="RESPONSE_Content-Security-Policy" pattern=".*" /> <action type="Rewrite" value="object-src 'none'; img-src 'self'; script-src 'self'; require-trusted-types-for 'script'" /> </rule>Removing the require-trusted-types-for and script-src directives allows the JS to function, but it also exposes the site to XSS vulnerabilities.
Does anyone have a solution to this issue? I have attempted using script-src url-of-base-site'
This particular resource seemed helpful, but it may be outdated and not address the inclusion of
require-trusted-types-for 'script';