Better CSP support

[Nuklon]

Right now some of the theme files use inline scripts, this is not compatible with blocking inline scripts in CSP policy.

[d-gibbs]

As a workaround, you can inject a CSP nonce into the Model.JavaScriptTagAttributes property of the FormViewModel before passing to Html.RenderFormsScripts...

This can be done in: \Views\Partials\Forms\Themes\default\Script.cshtml (line 54):

var tagAttributes = Model.JavaScriptTagAttributes ?? new Dictionary<string, string>();

if (!tagAttributes.ContainsKey("nonce"))
{
    tagAttributes.Add("nonce", "request nonce value goes here...");
}

@Html.RenderFormsScripts(Url, Model, tagAttributes)

This will ensure that any scripts injected by Umbraco.Forms have been whitelisted.

[sussexrick]

This was first requested in 2016 and shut down when I requested it again (#16). Umbraco is normally so good at being secure by default. It would be really helpful to see these inline scripts finally moved into separate .js files by default.

[AndyButland]

We've converted the instances of inline scripts into referenced files now, will be available in 8.11.0 and 9.3.0.