We are working on an ASP.NET Core MVC application running .NET 8. It is deployed on Azure through Azure App Service. We have implemented Content Security Policy in the application and have assigned nonce values to the JS scripts that are in use.
Recently, we are getting a console error stating,
Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘self’ ‘nonce-blabla’. Either the ‘unsafe-inline’ keyword, a hash (‘bla-bla’), or a nonce (‘nonce-…’) is required to enable inline execution.
It is coming from a script automatically injected by azure app insights. The source of the script that is causing the csp violation is https://js.monitor.azure.com/scripts/b/ai.2.min.js
We don’t have all the permissions related to the app service and we don’t have any app insights related config in the codebase. We have tried adding a bunch of domains to the CSP header to get rid of the csp violation but still we are not able to solve it.
Can anyone please give any suggestion on how to resolve the CSP violation for the automatically injected script?
Abdulla Nur Faisal is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
2