title: Passing server data to client script with Content Security Policy
body: <p>With the Content Security Policy header set on a web server (<a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" rel="noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP</a>), any inline script is blocked by modern browsers. It is recommended to place all javascript in .js files and configure the policy to authorize the domain where these .js files are hosted.</p>
  
  <p>Fine, but my question is how are we suppose to pass data from the server-side application to the client script ? </p>
  
  <p>For example if I want to call a js function which take server-side value as input, I still have to call the function like the code below (MVC.Net Razor View) in the page body which is blocked.</p>
  
  <pre><code>&lt;body&gt;
  ...
  &lt;input type="button" value="Test" onclick="DoSomething('@ViewData["SomeValue"]');" /&gt;
  ...
  &lt;/body&gt;
  </code></pre>
  
  <p>I found some way to pass data in the script src attribute querystring (<a href="http://feather.elektrum.org/book/src.html" rel="noreferrer">http://feather.elektrum.org/book/src.html</a>), but i'm not sure it is the best solution.
  I'm particulary worried about the caching issue of variables in src querystring. Is there a better way to do that ?</p>