Are there some recommendations or best practice for this topic?
I created some settings but there is still some issue. I am not sure what to consider as a normal set of issues and what needs to be solved. I tested my application with ZAP 2.15.
The Radzen.Blazor components rely on inline CSS (style="...") and JavaScript (onclick etc.) so those should be allowed by the CSP you are using.
We are checking our web application with OWASP ZAP (www.zaproxy.org) and it insists on strict CSP settings (which Radzen does not seem to conform to). So ZAP decides to flag medium risks for XSS. Do you have a rationale for weakening CSP?
What are those flagged risks?
Yes, dynamic component width and height rely on inline style attribute and there is no way around that. Inline JavaScript should have been eliminated.