Reduce reliance on inline styles
Why it matters
'unsafe-inline' in style-src lets injected style tags restyle the page, which can hide content or leak data through crafted CSS. It is common and lower risk than inline scripts, so treat it as a later improvement.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Move inline style blocks into stylesheets, or give them the same per-response nonce as your scripts or a hash. Style attributes need 'unsafe-hashes' or removal.
- Stage 1: try style-src without 'unsafe-inline' in Content-Security-Policy-Report-Only. Stage 2: enforce it once nothing your pages need is reported.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.