security web_security ai_generated true

XSS despite CSP — Content-Security-Policy allows unsafe-inline

ID: security/csp-header-bypass-inline-script

Also available as: JSON · Markdown
88%Fix Rate
90%Confidence
4Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

CSP with unsafe-inline directive effectively disables script-src protection.

generic

Workarounds

  1. 93% success Use nonce-based CSP and add nonce attribute to all legitimate inline scripts 
    script-src 'nonce-abc123'

    Sources: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src

  2. 88% success Move all inline scripts to external files and use strict-dynamic 
    script-src 'strict-dynamic' 'nonce-xxx'

    Sources: https://web.dev/articles/strict-csp

Dead Ends

Common approaches that don't work:

  1. Add unsafe-inline to fix CSP errors from inline scripts 92% fail

    unsafe-inline allows ANY inline script, completely defeating XSS protection

  2. Use both nonce and unsafe-inline together for compatibility 70% fail

    Browsers supporting nonces ignore unsafe-inline; those not supporting nonces allow all inline