I have an asp .net application that goes through Cloudfare for web security and then reaches the application.

When I load the application for the first time to Home page, the javascript and css files are blocked and when I navigate to other pages and come to the Home page there js and css files are not blocked.

This does not take place if the request doesnt flow throw Cloudfare .

Below is the error “

Refused to execute inline script because it violates the following Content Security Policy directive : "script-src https://www.origin/javascript/file1.js https://www.origin/javascript/file2.js 'sha256-....' 'sha256-...'. Either the 'unsafe-inline' keyword , a hash or a nonce is required to enable inline execution.“

Trying to understand what is it that Cloudfare is doing here so that the scripts are getting blocked on load and there is no problem when navigated to different pages and come back .

I do not want to add any ‘unsafe-inline’ keyword in coding just to bypass this issue . Is there anything that needs to be done for the js files for this?