Fix unsafe-inline with CSP Foundry
The Evaluate tab opens with a policy that has the usual problems, so you can see the findings and the automatic fixes before pasting your own.
- Paste your policy and read the high-severity findings first.
- Apply the safe automatic fixes for quoting, duplicates, object-src and base-uri.
- Collect Report-Only reports to find out which inline scripts you actually have.
- Replace each inline script with a file, a hash or a nonce, then remove unsafe-inline.
What to know
unsafe-inline in script-src allows any inline script to run, which is exactly what a cross-site-scripting attack injects. A policy that keeps it gives little protection against that class of attack, however long the rest of the list is.
The way out has three parts. Find the inline scripts (Report-Only reports and console errors list them). Move what you can into external files. For the rest, use a nonce or hash: modern browsers ignore 'unsafe-inline' in a directive that contains a nonce, hash or 'strict-dynamic', so you can keep it only as a fallback for very old browsers while the policy is strict in current ones.
Two details trip people up. Hash-based allowances break when the script text changes by one character. And an allowlisted host in script-src does not help if the host is known to serve JSONP endpoints or old AngularJS builds; the evaluator checks your hosts against Google's public lists of these.
Updated · Cosmovex
Questions
Why is unsafe-inline bad in script-src?
It lets any inline script run, including one injected by an attacker, so it removes the main protection of the policy against cross-site scripting.
What replaces unsafe-inline?
External script files, sha256 hashes for scripts that never change, or a per-response nonce, often combined with strict-dynamic.
Do I need unsafe-inline for styles?
Many sites keep it in style-src because inline styles are less dangerous than inline scripts, but hashes or nonces are better if your framework supports them.
Can I keep unsafe-inline as a fallback?
Yes: browsers that understand nonces, hashes or strict-dynamic ignore it, and only very old browsers use it.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
