Refused: inline script with CSP Foundry
The Decode tab opens with a real inline-script error. The browser includes the hash that would allow that exact script, and the tool extracts it for you.
- Paste the console error exactly as the browser prints it.
- Read the sha256 value the tool extracts; it is the hash of the blocked script text.
- Prefer moving the script to a file. If you must keep it inline, add the hash to script-src.
- If the script changes between requests, use a nonce instead of a hash.
What to know
When a policy has no 'unsafe-inline', inline <script> blocks, inline event handlers such as onclick, and javascript: URLs are blocked. The console message lists three ways out: the 'unsafe-inline' keyword, a hash, or a nonce. The hash in the message is the SHA-256 of the exact blocked script text, so adding it allows that script and nothing else.
'unsafe-inline' is the answer that removes the protection: it is what an XSS attack injects. A hash is safe for scripts that never change, but it breaks the moment the text changes by one character, including whitespace and build-time substitutions. A nonce is a random per-response value that you add both to the header and to the script tag; it suits server-rendered pages and needs a server that can generate it. Event-handler attributes are not covered by hashes at all unless you also add 'unsafe-hashes'; the better fix is addEventListener.
If a nonce or hash is present in a script-src, modern browsers ignore 'unsafe-inline' in that directive. That is why you sometimes see it kept as a fallback for old browsers. The Evaluate tab labels a leftover keyword as harmless when a nonce or hash makes it inert, and as a real weakness when nothing does.
Updated · Cosmovex
Questions
How do I allow one inline script with CSP?
Add its sha256 hash to script-src, or put a matching nonce on the tag and in the header. The browser prints the hash in the console error for the blocked script.
Why does my CSP hash stop working?
A hash covers the exact characters between the script tags. Any change, even whitespace or a different build output, gives a different hash. Use an external file or a nonce for scripts that change.
Do hashes work for onclick attributes?
Only with the 'unsafe-hashes' keyword, which weakens the policy. It is better to remove inline event handlers and attach them with addEventListener.
Is unsafe-inline ever acceptable?
For style-src it is a common trade-off because inline styles are less dangerous than inline scripts. For script-src it removes most of the protection and should be a last resort.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
