---
title: Content security policy
slug: cms-13/docs/content-security-policy
docTags: 
createdAt: 2026-07-30T20:22:05.208Z
---

A [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) (CSP) prevents cross-site scripting (XSS) attacks by controlling which scripts the browser executes. By default, embedded JavaScripts are disabled when CSP is enabled. This means Optimizely Digital Experience Platform (DXP) and apps that use [Client Resources](docId\:w1uOaGU5mSHrFwqRh4lEy) functionality fail to load. Add a nonce to the policy script directive and the script element to re-enable these scripts. See the [nonce documentation](https://content-security-policy.com/nonce/) for background.

ASP.NET does not have a built-in API for CSP. Third-party libraries provide one, and most include an API for nonce generation. However the policy is constructed, the `Client Resource` feature must know that a nonce is required when rendering script elements. Choose one of the following approaches:

## Bring your nonce

Use a third-party library nonce when the CSP library already generates one. Enable the CSP nonce by calling the following in startup and using the library service to retrieve the nonce:

```csharp
services.AddContentSecurityPolicyNonce(sp => sp.GetRequiredService<IThirPartyNonceProvider>().GetNonce());
```

Then follow the library recommendation for configuring and rendering the policy.

## Use an autogenerated nonce

When no external nonce provider is needed, CMS generates a nonce for each request automatically. Call `AddContentSecurityPolicyNonce` without arguments:

```csharp
services.AddContentSecurityPolicyNonce();
```

Retrieve the generated nonce with `ICspNonceService` and add it to the script directive in the policy:

```csharp
private readonly ICspNonceService _nonceService;
var policy = $"default 'self'; script-src 'nonce-{_nonceService.GetNonce()}' 'strict-dynamic'";
```

:::hint{type="info"}
**Note**
In either case, add [strict-dynamic](https://content-security-policy.com/strict-dynamic/) to the script directive in the policy for best support.
:::