unsafe-inline explained
'unsafe-inline' allows inline scripts or styles to run. It is convenient, but it removes one of the biggest security benefits of CSP.
What it allows
When you add 'unsafe-inline' to script-src or style-src, the browser can run inline blocks and many HTML attribute-based event handlers again.
Why it is risky
- Injected inline script becomes much easier to execute.
- Old HTML event handlers become viable XSS entry points.
- Your CSP may look enabled while the strongest protection is weakened.
Better replacements
- Move code into external JS files when you can.
- Use a per-request nonce for dynamic pages.
- Use hashes for fixed inline snippets on static pages.
- Replace inline event handlers with
addEventListener.