CSP compatibility – requirement for unsafe-inline in style-src

[Jack Webb]

We are integrating your components in an application with a strict Content Security Policy (CSP). As part of our security baseline, we want to dissalow unsafe-inline in style-src.

1. Do your components require unsafe-inline for style-src to function correctly?
2. If yes, which specific features/components depend on it?
   
3. Is there a supported way to use your library without unsafe-inline (e.g. via nonces, hashes, or externalized styles)?
   
4. Are there any official guidelines or configurations for running your components under a strict CSP?
   

[AngelinFaithSheeba PaulvannanRajadurai]

Hi Jack,

Thank you for reaching out to us. Our Blazor Pivot Table component supports most features under a strict Content Security Policy (CSP) without requiring 'unsafe-inline'. However, expect Pivot Chart, Conditional Formatting currently depend on inline styles and will not function if 'unsafe-inline' is disallowed in the style-src directive of a strict CSP.

For your reference, we’ve shared the CSP guidelines specific to the Pivot Table below:

CSP Guidelines : https://blazor.syncfusion.com/documentation/pivot-table/content-security-policy

If you need any further assistance or clarification, please feel free to reach out—we’re always here to help!

Regards,

Angelin Faith Sheeba.

[Jack Webb]

Thanks for the answer Angelin, I had to choose a component to ask the question, however the question is about the whole Syncfusion component library, not just the Pivot Table. What components do/do not require 'unsafe-inline'?

[Karthickraja MuthuRaman]

Hi Jack,

Thank you for reaching out with the update. We understand that you are seeking clarity on which Syncfusion Blazor components require or do not require the use of unsafe-inline when working under a strict Content Security Policy (CSP).

To assist with this, we recommend reviewing our dedicated User Guide documentation. It provides detailed guidance on Syncfusion Blazor components and clearly explains their compatibility with strict CSP configurations, including scenarios where unsafe-inline may or may not be necessary.

UG: https://blazor.syncfusion.com/documentation/common/content-security-policy#syncfusion-support-for-strict-csp

If you have any additional questions, need further clarification, or require assistance beyond what is covered in the documentation, please feel free to reach out. We are always happy to help and ensure all your concerns are fully addressed.

Regards,

Karthickraja