Content-Security-Policy not support in asp.net

Problem:

In classic ASP.NET (not ASP.NET Core), adding CSP headers using this syntax in web.config often doesn’t work:

because:

1. IIS doesn’t always pass custom headers correctly when added under in older framework versions.

2. Certain middleware or modules (e.g., Forms Authentication or URL Rewrite) may overwrite or remove the header.

Correct Way (for ASP.NET Web Forms / MVC in web.config)

Add this inside:

Verify It Works

After saving web.config, restart the app (or IIS), and then open the site in a browser.
Check the response headers:

1. Open Developer Tools (F12) ? Network tab

2. Refresh your page

3. Select your main request and look under Response Headers

You should see:

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';

If it’s missing, see the next step

If It Still Doesn’t Work

Add the header programmatically in Global.asax instead:

protected void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext.Current.Response.Headers.Add(
        "Content-Security-Policy",
        "default-src 'self'; script-src 'self'; object-src 'none';"
    );
}

This method guarantees that the CSP header is sent for every request.

Summary

In your web.config, under → → , add: