I am working on a mvc application where we used inline event handlers "onClick='doSomething()'" at many places in the past.
Now we are implementing CSP header which treats the following as inline script and fails to execute it with the error "Refused to execute inline event handler"
<button onClick="doSomething()">Create</button>
I just want to ask is there a way to use nonce with inline event handlers? So that I don't have to use "unsafe-eval" or "unsafe-hashes"