What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
If a strict Content Security Policy blocks a Blazor import map, do not solve it by allowing 'unsafe-inline' across the application. In a Blazor Web App, the ImportMap component emits an inline <script> element in the document head. A restrictive script-src (or inherited default-src) therefore causes the browser error Refused to execute inline script because it violates the following Content Security Policy directive
.
Microsoft documents two narrower remedies: attach a fresh cryptographic nonce to the rendered import map and list that nonce in script-src, or calculate a Subresource Integrity (SRI) hash for the exact import-map content and allow that hash. The right choice depends on how your application creates its CSP and whether the map is stable or generated for each response.
As an Amazon Associate I earn from qualifying purchases.
Why does Blazor’s import map trigger a CSP violation?
The ImportMap component writes an inline script containing the module-specifier map that Blazor uses to resolve framework and application modules. Browsers treat that element as inline script, even though its purpose is configuration rather than executable application logic. A policy such as script-src 'self' permits external files from the site but does not automatically permit inline script blocks, so the map is refused.
The same failure can appear when script-src is absent and default-src supplies the restrictive fallback. The console wording shown in Microsoft’s guidance is illustrative; it is the browser reporting a policy decision, not an indication that the import map itself is malicious. The relevant implementation and policy examples are in Microsoft’s ASP.NET Core Blazor CSP guidance.
#1 Best Overall
Which Blazor and .NET versions have these options?
Blazor Web Apps introduced the import-map behavior in the .NET 8 era, while the documented nonce and SRI support for the ImportMap component is described for .NET 9 and later. The documentation view cited for the current guidance is the .NET 10 release context. Check the target framework and installed ASP.NET Core packages before copying an example: an older application may not expose the same component parameters or rendering behavior.
- Blazor Web App: expect an import map in the document head when the component is used.
- .NET 9 or later: use the documented nonce or SRI attributes on
ImportMap. - Older targets: verify the component API in the documentation for that target, and do not assume a sample written for .NET 9 or .NET 10 compiles unchanged.
How does a nonce fix the import map?
A nonce is a cryptographically random value generated for one response. The browser accepts an inline script only when its nonce attribute matches a nonce source in the response’s script-src directive. The CSP and the rendered ImportMap must receive the same value, and a later response must receive a new value.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →1. Generate the value at the response’s rendering scope
Generate the nonce with a cryptographic random-number generator rather than a timestamp, counter, GUID used as a convenience token, or other predictable value. Microsoft’s example uses a byte array and Base64 encoding:
@using System.Security.Cryptography
@code {
private string? nonce;
protected override void OnInitialized()
{
using var rng = RandomNumberGenerator.Create();
var bytes = new byte[32];
rng.GetBytes(bytes);
nonce = Convert.ToBase64String(bytes);
}
}The byte count in this illustration follows the documented pattern; it is not a universal CSP requirement. What matters is that the value is unpredictable, suitable for use in a CSP token, and available wherever the response policy and component are rendered.
2. Put the identical nonce in the policy and on ImportMap
Deliver the policy in the response and pass the same value to the component. A conceptual Razor arrangement is:
<meta http-equiv='Content-Security-Policy'
content="script-src 'self' 'nonce-@nonce'; ..." />
<ImportMap nonce='@nonce' />An HTTP response header is commonly used for CSP, while a meta element is shown here to make the relationship visible. Whichever delivery method your hosting model uses, the nonce source must be present in the policy that the browser applies to this document.
Recommended Free Tools
Rank #2
- Comes with secure packaging
- It can be a gift item
- Easy to read text
3. Keep generation, rendering, and caching aligned
- Generate one nonce for the document response and reuse it only for the policy and the matching import-map element in that response.
- Do not cache a rendered document containing yesterday’s nonce while sending a newly generated CSP header, or vice versa.
- Do not reuse a nonce across responses. A response cache or rendering boundary that separates policy generation from component rendering can create mismatches.
- If more than one inline script is intentionally authorized, add the same response nonce to each approved element; do not replace it with a site-wide
'unsafe-inline'allowance.
The ImportMap component accepts additional rendered attributes through its component parameters, including the nonce shown above. Confirm the generated HTML contains the attribute and inspect the final response headers rather than relying only on source files.
How does SRI authorize a generated import map?
Subresource Integrity authorizes content by hash. For an import map, calculate the integrity value from the exact serialized definition that the component will render, then provide that value as an integrity attribute and allow the corresponding hash in the CSP. The browser compares the bytes it receives with the expected digest before executing the inline map.
1. Serialize the same definition that will be rendered
Microsoft’s SRI approach uses the ImportMapDefinition serialization, normalizes line endings, and derives the integrity value from that resulting content. The calculation must happen from the final representation, not from a hand-written approximation or a different JSON formatter.
@using System.Security.Cryptography
@using System.Text
@code {
private IDictionary<string, object> ImportMapAttributes()
{
// Serialize the ImportMapDefinition exactly as the component will render it.
// Normalize line endings before hashing, as required by the documented pattern.
var serialized = SerializeImportMapDefinition();
var normalized = serialized.Replace("rn", "n").Replace("r", "n");
var digest = SHA256.HashData(Encoding.UTF8.GetBytes(normalized));
var integrity = "sha256-" + Convert.ToBase64String(digest);
return new Dictionary<string, object>
{
["integrity"] = integrity
};
}
}The serialization call above is deliberately a stand-in for the serialization performed by your application and component version; use the API and sample for your target framework. The important rules are to hash the exact generated definition, use the documented line-ending normalization, and emit the resulting sha256-... value without changing the content afterward.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors2. Pass the integrity attribute to the component
The component can receive extra attributes through AdditionalAttributes. In practice, create the attribute dictionary after computing the digest and supply it when rendering ImportMap. The CSP must also contain the matching hash source in script-src; an integrity attribute by itself does not override a policy that blocks the inline element.
3. Recalculate when the map changes
Fingerprinting can make the generated import map different on every request because asset URLs or mappings change with the response. In that situation, a single hard-coded hash eventually becomes wrong. Compute the SRI value from the map generated for that response, or choose a nonce if your pipeline can reliably share one per response.
Rank #3
Should you choose a nonce or SRI?
Neither method is universally best. Choose the mechanism that matches your response-generation and deployment pipeline, then verify the final policy and HTML together.
| Choice | Best fit | Main condition | What to verify |
|---|---|---|---|
| Cryptographic nonce | A response pipeline that can generate and propagate one value per document | The CSP and the rendered ImportMap receive the same fresh nonce |
No cache or rendering boundary causes a mismatch or reuses the value |
| SRI hash | A pipeline that can derive an integrity value from the final import-map content | The hash allow-list and component attribute match the generated map | Serialization and line-ending normalization are identical to the rendered output; request-specific maps are rehashed |
A nonce is usually simpler when the map is generated dynamically and the application already has per-response policy middleware. SRI can be attractive when the import-map content is deterministic and your build or rendering pipeline can calculate the digest reliably. Microsoft documents both approaches and does not declare one the correct choice for every Blazor application.
What CSP directives does a Blazor app need besides the import-map exception?
Allowing the import map addresses one inline-script violation only. The rest of the policy must reflect the app’s hosting model, runtime, resources, and event handlers.
Client-side Blazor and WebAssembly
Microsoft’s guidance identifies wasm-unsafe-eval for the Mono runtime used by client-side Blazor. Without the directive, a WebAssembly application can fail even after the import map is authorized. Add it only when the client-side runtime requires it, and test whether your chosen hosting mode actually uses that runtime.
Inline event handlers and styles
Framework-generated handlers or inline styles can produce separate console violations. Microsoft shows an unsafe-hashes example for a framework onclick handler. A nonce or SRI hash for the import map does not authorize unrelated handlers, so diagnose each message independently rather than adding 'unsafe-inline' as a catch-all.
Connections, images, workers, and other resources
Blazor applications may need connect-src entries for APIs, SignalR, or WebSocket endpoints, along with suitable image, style, worker, font, and frame directives. The required sources vary with deployment, authentication, prerendering, and third-party resources. Treat Microsoft’s policy as a starting point and construct the final allow-list from the resources your own application actually loads.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How do you troubleshoot a remaining CSP error?
Use the browser’s first blocked-resource message as a diagnostic clue, not as proof that every directive is wrong. Work through the following sequence:
- Capture the applied policy. Inspect the response headers and any CSP meta element in the document that failed. Confirm which policy the browser enforced and whether another policy is also present.
- Inspect the rendered import map. Verify that the
<script type='importmap'>element has the expected nonce or integrity attribute and that the attribute is not empty after prerendering. - Compare values byte-for-byte. For a nonce, compare the element’s value with the exact
'nonce-...'token inscript-src. For SRI, recalculate from the final serialized text, including normalized line endings. - Check response caching. A cached HTML document and a freshly generated policy can disagree. Temporarily bypass the cache while diagnosing, then design cache keys and rendering so the policy and markup are produced as one coherent response.
- Separate violations. An error about an inline event handler, a WebAssembly evaluation, a connection, or a stylesheet requires its own directive review. Do not weaken the import-map fix to address an unrelated resource.
- Retest every rendering mode. Exercise prerendered and interactive pages, authenticated and anonymous responses, development and production builds, and any CDN or reverse-proxy path. A policy that works for one response shape can fail for another.
Does a nonce or SRI hash make the Blazor application secure?
No. These controls narrowly authorize trusted import-map content under a strict CSP; they do not turn CSP into a complete application-security boundary. Microsoft notes that CSP cannot guarantee freedom from every XSS or clickjacking issue and does not address SQL injection, cross-site request forgery, security misconfiguration, denial of service, or other classes of attack.
Continue to encode and validate untrusted data, enforce authorization on the server, protect state-changing requests against CSRF where applicable, secure database access, configure framing and transport controls, and keep dependencies current. Review CSP as defense in depth: useful for reducing exploitability, but never a substitute for fixing the underlying vulnerability.
Production checklist for a strict Blazor CSP
- Confirm the application’s target framework and the
ImportMapAPI available in that version. - Choose a per-response nonce or content-derived SRI based on whether the map is dynamic and whether your pipeline can propagate or hash it reliably.
- Generate nonce material with a cryptographic random-number generator and never reuse it across responses.
- Ensure the CSP and rendered component receive exactly the same nonce, or exactly the same SRI digest.
- For SRI, serialize the actual
ImportMapDefinition, normalize line endings as documented, and hash the bytes that will be rendered. - Account for fingerprinted assets that can change the map between requests.
- Inspect cache, prerendering, CDN, and reverse-proxy behavior for policy/markup mismatches.
- Add only the other directives your app needs, such as
wasm-unsafe-evalfor the client-side Mono runtime, and investigate each separate violation. - Test all deployment environments and retain the browser console output for regressions.
- Keep the rest of the application’s security controls independent of CSP.
Frequently Asked Questions
Why does the import map work in development but fail after deployment?
Production builds commonly fingerprint assets, which can change the generated map and expose caching or response-generation differences. Compare the deployed document, its applied CSP, and the actual import-map bytes instead of assuming the development policy and markup are identical.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I use one nonce for the whole site?
A nonce should be unpredictable and generated for each response. Reusing a fixed value or sharing it across responses defeats the purpose of nonce-based authorization and can also create mismatches when cached documents and headers are combined.
What if the nonce is present but the browser still blocks the map?
Check that the token in script-src includes the 'nonce- prefix and exactly matches the element attribute, including encoding. Also verify that a second enforced policy, stale cached HTML, or a different rendering path is not blocking the document.
Is an import-map SRI hash reusable after changing a package version?
Not necessarily. Changing a package, an asset fingerprint, serialization, or line endings changes the bytes being hashed. Recompute the integrity value from the newly rendered definition and update the matching CSP hash source.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
