After removing unsafe-inline and unsafe-eval from Sitefinity pages as per Sitefinity article: Security: Creating a separate Web Security module / CSP headers for frontend and backend site and ensuring all inline scripts are removed from pages and widgets the CSP header still reports problems with inline scripts.

All scripts are loaded via

<script src="main.js" />

but this doesn`t solve the problem.

The problem in this scenario is not about javascript being placed inline or not. It is about the JS code itself. The JS code even when loaded via <script src="file.js" /> contains unsafe JS functions like:

setTimeout

window.location = "javascript.."

which are utilizing browser functionality which is unsafe and CSP header will block it. The functions in the loaded JS files on a page have to be reviewed for use of unsafe JS functions.

Review the JS code loaded onto pages and ensure it doesn`t use unsafe JS functions like

setTimeout

window.location = "javascript.."

rewriting the code to maintain functionality and replace those functions with other will be needed.

CSP nonce:

The other solution is to use CSP nonce for the JS files which are utilizing unsafe functions, but using CSP nonce will require 100% client to server communication between each user visiting a page which loads JS file with nonce and the hosting server.

The hard requirement for nonce is to have the hosting server issue unique nonce for each user requesting a JS resource. With this hard requirement at hand the Sitefinity output caching has to be stopped which is not recommended and will lead to performance problems with the site. Opening up a vertical for DDoS on pages with disabled caching as well.

It best to avoid stopping output caching on pages and stick to loading / utilizing only secure JS functions and libraries in the site.