Hello,

Thank you for your feature request and patience.

After thorough evaluation, we must decline this request as implementing nonce or SHA256 hash CSP support for Telerik UI for ASP.NET AJAX is not technically feasible due to fundamental limitations in the Microsoft ASP.NET WebForms framework itself.

Why this cannot be implemented:

Microsoft has officially stated in their IIS Support Blog:

"There's no way for a webforms app to run with a CSP without allowing unsafe-inline on scripts... As webforms is considered complete, with no new features being added, this isn't going to change."

The core issue is that ASP.NET WebForms and Microsoft AJAX framework automatically generate script tags (via ScriptResource.axd, WebResource.axd, Sys.WebForms, etc.) that Telerik cannot control or modify. Even if we implemented nonce injection for Telerik controls, the framework-generated scripts would remain without nonce attributes and be blocked by the browser's CSP policy.

We understand this is not the answer you were hoping for, but we believe it is important to provide clarity on the technical constraints involved.

Regards,
Rumen
Progress Telerik

Hi Rick,

For Kendo UI, ASP.NET MVC and Core, please refer to the following Kendo UI feedback portal on the matter https://feedback.telerik.com/kendo-jquery-ui/1359789-csp-support, check Carl's answer on 31 Oct 2019 11:09 and post your questions and comments for Kendo related product there.

Best Regards,
Rumen
Progress Telerik

Thank you for your feature request!

You are the first customer to request support for nonce and sha256 hash for CSP for Telerik ASP.NET AJAX controls.

The problem with them is that you cannot control the script tags which are imported by the ASP.NET Web Forms framework.

Even if we come up with a property or method that will allow you to call your own code that gives this nonce - we can't do anything for the scripts from the ASP.NET AJAX framework.

Best Regards,

Rumen
Progress Telerik