Blazor Virtualize requires inline styles, preventing strict CSP enforcement

[vsfeedback]

This issue has been moved from a ticket on Developer Community.

---

The Blazor component applies inline styles internally for layout and item positioning. Due to this dependency, it is not feasible to enforce a strict Content Security Policy (CSP) without allowing unsafe-inline, which does not meet our security requirements.

Could you please confirm whether this behavior is expected and advise if there are plans or recommended approaches to make compatible with strict CSP configurations?

Reproduction steps

• Create a Blazor Server or Blazor WebAssembly application.
• Configure a strict CSP (for example, disallowing unsafe-inline in style-src).
• Add the component to a page.
• Run the application and observe the browser console.

---

Original Comments

Feedback Bot on 4/16/2026, 06:52 AM:

We have directed your feedback to the appropriate engineering team for further evaluation. The team will review the feedback and notify you about the next steps.

Kirupa Karan Raj Kumar on 4/28/2026, 07:51 AM:

Hi Team,

Any update on this query?

Regards,
Kirupa.

[github-actions]

Triage Summary

Area: area-blazor (Issue concerns the <Virtualize> component, which is part of Blazor/Razor Components in src/Components/)

Type: feature-request (The author is asking for the Virtualize component to be made compatible with strict CSP configurations by removing dependency on inline styles. This is an enhancement request rather than a bug, as the current behavior appears to be the intended implementation.)

Potential Duplicates

• None found

Related Issues

• WebAssembly.Authentication breaks content security policy, requires unsafe-eval #64952 - WebAssembly.Authentication breaks content security policy, requires unsafe-eval (related CSP concern but different component and different CSP directive: unsafe-eval vs unsafe-inline for styles)

Notes

• The issue requests that the <Virtualize> component be redesigned to avoid inline styles, allowing apps to enforce strict CSP without unsafe-inline in style-src.
• This is a valid enhancement request as CSP compatibility is an important security consideration for modern web applications.
• The component currently uses inline styles for layout and positioning, which is an architectural decision that would require refactoring to address.

Generated by Issue Triage Agent for dotnet/aspnetcore for issue #66840 · ● 526.1K · ◷

[oroztocil]

There is a fix in the making (#66680) but it did not get into Preview 5.