Strict CSP Implementation

[joelcc]

Hello everyone,

I am currently working on hardening an IntraWeb application (IW 16.1.9, standalone execution) that relies on HTML Bootstrap templates and custom JavaScript/jQuery.

During a recent penetration test and security audit, the use of 'unsafe-eval' and 'unsafe-inline' in our Content Security Policy (CSP) headers was flagged as a high-risk finding.

While we are in the process of implementing dynamic request-based nonce values for external scripts and templates, we understand that IntraWeb's core rendering engine heavily relies on:

Inline event handlers (onclick, onchange, etc.) generated by native IW controls.

Async/AJAX response processing, which dynamically evaluates incoming JS snippets on the client side.

Given these architectural constraints:

Is there an official or recommended pattern to achieve strict CSP compliance within IntraWeb without breaking the core AJAX functionality?

Beyond using nonces, are there specific ServerController configs, event hooks, or best practices to eliminate or strictly limit the exposure of 'unsafe-eval' and 'unsafe-inline'?

Any insights, workarounds, or roadmap details regarding future CSP enhancements in IW 16.x would be greatly appreciated.

Thanks in advance for your guidance!

Best regards

Here some things I did years ago for some of what you are doing.   (Look at the comments in the links)
procedure TController.IWServerControllerBaseParseParameter(var AParam: string;
  var AllowIt: Boolean; const Index: Integer);
  var
    n : integer;
begin

//We are going to stop all parameters unless we need to check for a certain param
  //https://www.atozed.com/forums/thread-1681.html
  if CCAppParams.ApplicationParams.URLStartParams.URLStartParamAllowList <> '' then
  begin
      Paramcriticalsection.Acquire;
      try
      for n := 0 to ParamStringList.count-1 do
      begin
          if (Copy(uppercase(AParam),1,POS('=',uppercase(AParam))-1) = uppercase(ParamStringList[n])) then
          begin
            AllowIt := True;
            exit;
          end else
          begin
            AllowIt := False;
          end;
      end;
      finally
        Paramcriticalsection.release;
      end;
  end else
  begin
    AllowIt := False;
    exit;
  end;

//  if ContainsText(AParam, '<svg') then
//    AllowIt := False;
//
////This fixes an issue with a cross scripting possibility in versions at or prior to 5.2.18 and only with firefox
////https://www.atozed.com/forums/thread-2034.html
//  if ContainsText(AParam, 'onbeforescriptexecute') then
//    AllowIt := False;

  if ((ContainsText(AParam, 'onbeforescriptexecute')) or
      (ContainsText(AParam, 'onafterscriptexecute'))) then
    AllowIt := False;


end;