security security_error ai_generated true

Refused to execute inline script because it violates Content-Security-Policy

ID: security/csp-unsafe-inline

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Content Security Policy blocks inline scripts. Adding unsafe-inline defeats the purpose of CSP.

generic

Workarounds

  1. 90% success Use nonce-based CSP for inline scripts 
    Content-Security-Policy: script-src nonce-{random}
  2. 88% success Move inline scripts to external files 
    Extract <script> blocks to .js files and reference via src

Dead Ends

Common approaches that don't work:

  1. Add unsafe-inline to CSP header 90% fail

    Defeats the purpose of CSP - allows XSS attacks through inline injection.

  2. Disable CSP entirely during development and forget to re-enable 95% fail

    Leaves production vulnerable to XSS.