<div>
Content-Security-Policy is not intended to 'hide' elements on a page but to restrict where files can be loaded from. <a href="https://www.owasp.org/index.php/Content_Security_Policy" rel="ugc">https://www.owasp.org/index.php/Content_Security_Policy</a><br />
<br />
Show us the 'View Source' for this from your browser. &nbsp;All elements that start with &quot;&lt;asp:...&quot; are converted to plain HTML values when they are sent to the browser.
</div>


Content-Security-Policy is not intended to 'hide' elements on a page but to restrict where files can be loaded from. https://www.owasp.org/index.php/Content_Security_Policy [https://www.owasp.org/index.php/Content_Security_Policy]

Show us the 'View Source' for this from your browser.  All elements that start with "<asp:..." are converted to plain HTML values when they are sent to the browser.

<div>
<div class="content wysiwyg-content">
Hi<br />
When HTTP Header Content-Security-Policy is set to &quot;Default-src 'self', ASP text box does not get hidden<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2017/12_w50/1215379/ScreenHunter_90-Dec.-14-15.04.jpg" target="_blank" title="Content-Security-Policy to Default-src 'self' on IIS (50 KB)"><img alt="Content-Security-Policy to Default-src 'self' on IIS" class="file-block lazyload" style="max-width: 677px;" data-src="https://filedb.experts-exchange.com/incoming/2017/12_w50/1215379/ScreenHunter_90-Dec.-14-15.04.jpg" /></a><br />
This is the piece of code which used to be &quot;hidden&quot; from user, but by setting Content-Security-Policy to Default-src 'self', it shows up on the UI on FireFox and Chrome. It hides correctly on IE. &nbsp;<br />
<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;div style=&quot;position: relative; float: left;&quot;&gt;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;asp:TextBox ID=&quot;txtTop&quot; runat=&quot;server&quot; Width=&quot;0px&quot; Height=&quot;0px&quot; Style=&quot;background: #517ca6;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; background-color: #517ca6; color: #517ca6;&quot; BorderStyle=&quot;None&quot;&gt;&lt;/asp:T<wbr />extBox&gt;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/div&gt; <br />
<br />
Any suggestion on how we can keep the control hidden, and be able to set Content-Security-Policy to Default-src 'self'?
</div>
</div>


Content-Security-Policy to Default-src 'self' on IIS

ScreenHunter_90-Dec.-14-15.04.jpg

Hi
When HTTP Header Content-Security-Policy is set to "Default-src 'self', ASP text box does not get hidden



This is the piece of code which used to be "hidden" from user, but by setting Content-Security-Policy to Default-src 'self', it shows up on the UI on FireFox and Chrome. It hides correctly on IE.  

            <div style="position: relative; float: left;">
                <asp:TextBox ID="txtTop" runat="server" Width="0px" Height="0px" Style="background: #517ca6;
                    background-color: #517ca6; color: #517ca6;" BorderStyle="None"></asp:TextBox>
            </div> 

Any suggestion on how we can keep the control hidden, and be able to set Content-Security-Policy to Default-src 'self'?

When HTTP Header Content-Security-Policy is set to &quot;Default-src 'self', ASP text box does not get hidden

Active Server Pages (ASP) is Microsoft’s first server-side engine for dynamic web pages. ASP’s support of the Component Object Model (COM) enables it to access and use compiled libraries such as DLLs. It has been superseded by ASP.NET, but will be supported by Internet Information Services (IIS) through at least 2022.

UI stands for User Interface and UX for User Experience. While there are key differences between the two, both concern the design of how humans interact with computer systems and software.

UI/UX

Chrome is a free web browser created by Google. Originally released in 2008, it has grown to become the most used desktop web browser (as of October 2016).

Chrome

Web browsers are applications used primarily to display documents, files and media from the Internet, identified by a Uniform Resource Identifier (URI) that can be a page, image, video or other file. Some browsers require the use of add-ons or extensions to safely render the information they receive; others have systems built into them to perform the same functions.

When HTTP Header Content-Security-Policy is set to &quot;Default-src 'self', ASP text box does not get hidden

When HTTP Header Content-Security-Policy is set to "Default-src 'self', ASP text box does not get hidden