<commit_before>---
title: Content Security Policy Mode
page_title: Content Security Policy Mode
description: "Learn more about the Content Security Policy (CSP) mode and how to work with it in Telerik UI for ASP.NET AJAX and Microsoft AJAX projects."
slug: general-information/content-security-policy
previous_url: general-information/troubleshooting/content-security-policy
tags: telerik, asp, net, ajax, content, security, policy, csp, unsafe-eval, eval, microsoft
published: True
position: 5
---

# Content Security Policy Mode

If the strict `Content-Security-Policy` (CSP) mode is enabled, it disables the following browser features by default:

* Inline JavaScript, such as `<script></script>`, or DOM event attributes, such as `onclick`, are blocked. All script code must reside in separate files that are served from a white-listed domain.

* Dynamic code evaluation through `eval()` and string arguments for both `setTimeout` and `setInterval` are blocked.

## Working with Telerik UI for ASP.NET AJAX

Telerik UI for ASP.NET AJAX uses `eval()` calls and inline `<script>` tags. Thus, Telerik UI for ASP.NET AJAX does not currently support the strict CSP mode.

If CSP is enabled for a web application, which utilizes Telerik UI for ASP.NET AJAX, you have to add at least the `unsafe-eval` and `unsafe-inline` keywords to the `script-src` section of the `meta` tag or `HTTP header` that are used for enabling the CSP mode.

To allow font icons, raster icons, and inline style attributes that are also heavily used by the Telerik UI for ASP.NET AJAX suite, you must also add the `unsafe-inline` keyword for the `style-src` section.

>caption Minimal configuration to run Telerik UI for ASP.NET AJAX with the CSP mode
````HTML
<meta
    http-equiv="Content-Security-Policy"
    content="script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' ;"
     />
````

To work with CDN, you must also add the `self` keyword to the `font-src` and `img-src` sections. Make sure that you also include their domains in the `script-src`, `style-src`, `font-src`, and `img-src` sections.

>caption Using Telerik UI for ASP.NET AJAX with CDN over HTTPS (SSL)
````HTML
<meta
    http-equiv="Content-Security-Policy"
    content="script-src 'self' 'unsafe-inline' 'unsafe-eval' https://d2i2wahzwrm1n5.cloudfront.net ;
			 style-src 'self' 'unsafe-inline' https://d35islomi5rx1v.cloudfront.net ;
			 font-src 'self' https://d35islomi5rx1v.cloudfront.net 'data:';
			 img-src 'self' https://d35islomi5rx1v.cloudfront.net 'data:'"
     />
````

>caption Using Telerik UI for ASP.NET AJAX with CDN over plain HTTP
````HTML
<meta
    http-equiv="Content-Security-Policy"
    content="script-src 'self' 'unsafe-inline' 'unsafe-eval' https://aspnet-scripts.telerikstatic.com ;
			 style-src 'self' 'unsafe-inline' https://aspnet-skins.telerikstatic.com ;
			 font-src 'self' https://aspnet-skins.telerikstatic.com 'data:';
			 img-src 'self' https://aspnet-skins.telerikstatic.com 'data:'"
     />
````<commit_msg>docs(CSP): fix the https urls in the HTTP example<commit_after>---
title: Content Security Policy Mode
page_title: Content Security Policy Mode
description: "Learn more about the Content Security Policy (CSP) mode and how to work with it in Telerik UI for ASP.NET AJAX and Microsoft AJAX projects."
slug: general-information/content-security-policy
previous_url: general-information/troubleshooting/content-security-policy
tags: telerik, asp, net, ajax, content, security, policy, csp, unsafe-eval, eval, microsoft
published: True
position: 5
---

# Content Security Policy Mode

If the strict `Content-Security-Policy` (CSP) mode is enabled, it disables the following browser features by default:

* Inline JavaScript, such as `<script></script>`, or DOM event attributes, such as `onclick`, are blocked. All script code must reside in separate files that are served from a white-listed domain.

* Dynamic code evaluation through `eval()` and string arguments for both `setTimeout` and `setInterval` are blocked.

## Working with Telerik UI for ASP.NET AJAX

Telerik UI for ASP.NET AJAX uses `eval()` calls and inline `<script>` tags. Thus, Telerik UI for ASP.NET AJAX does not currently support the strict CSP mode.

If CSP is enabled for a web application, which utilizes Telerik UI for ASP.NET AJAX, you have to add at least the `unsafe-eval` and `unsafe-inline` keywords to the `script-src` section of the `meta` tag or `HTTP header` that are used for enabling the CSP mode.

To allow font icons, raster icons, and inline style attributes that are also heavily used by the Telerik UI for ASP.NET AJAX suite, you must also add the `unsafe-inline` keyword for the `style-src` section.

>caption Minimal configuration to run Telerik UI for ASP.NET AJAX with the CSP mode
````HTML
<meta
    http-equiv="Content-Security-Policy"
    content="script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' ;"
     />
````

To work with CDN, you must also add the `self` keyword to the `font-src` and `img-src` sections. Make sure that you also include their domains in the `script-src`, `style-src`, `font-src`, and `img-src` sections.

>caption Using Telerik UI for ASP.NET AJAX with CDN over HTTPS (SSL)
````HTML
<meta
    http-equiv="Content-Security-Policy"
    content="script-src 'self' 'unsafe-inline' 'unsafe-eval' https://d2i2wahzwrm1n5.cloudfront.net ;
			 style-src 'self' 'unsafe-inline' https://d35islomi5rx1v.cloudfront.net ;
			 font-src 'self' https://d35islomi5rx1v.cloudfront.net 'data:';
			 img-src 'self' https://d35islomi5rx1v.cloudfront.net 'data:'"
     />
````

>caption Using Telerik UI for ASP.NET AJAX with CDN over plain HTTP
````HTML
<meta
    http-equiv="Content-Security-Policy"
    content="script-src 'self' 'unsafe-inline' 'unsafe-eval' http://aspnet-scripts.telerikstatic.com ;
			 style-src 'self' 'unsafe-inline' http://aspnet-skins.telerikstatic.com ;
			 font-src 'self' http://aspnet-skins.telerikstatic.com 'data:';
			 img-src 'self' http://aspnet-skins.telerikstatic.com 'data:'"
     />
````
{'fraction_non_alphanumeric': 0.11175115207373272, 'fraction_numerical': 0.005595786701777485, 'mean_word_length': 4.373121131741821, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 21, 'https://': 12, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '935804', 'n_tokens_mistral': 1962, 'n_tokens_neox': 1815, 'n_words': 716}