Best practice for removing unsafe-inline code from elements . . . I have tried moving the command from onclick="" to data-onclick="" and then run it via a unified script that would run the script in the data-onclick attribute, but without unsafe-eval, the browser won't allow it, which is logical
My Journey to Removing unsafe-eval from CSP: A Step-by-Step Guide After facing significant challenges while trying to eliminate unsafe-eval from an existing application's Content Security Policy (CSP), I finally developed a robust and generic solution that other developers can easily adopt and extend
Fixing unsafe-inline | CSP Hero TL;DR: Avoid using unsafe-inline Instead, move inline scripts into separate files, or utilize the hash nonce mechanisms The CSP (content security policy) is a low-hanging fruit - an easy way to improve security significantly To fully benefit from CSP, it's better to adhere to the default rules and refrain from allowing 'unsafe-inline'
3069320 - Removing of unsafe-* information in Content . . . Possibility of removing unsafe-* information in Content Security Policy (CSP) in CSB Does the presence of “unsafe-inline” and “unsafe-eval” keywords mean there is a security violation SAP Knowledge Base Article - Public
unsafe-inline CSP Guide - Content-Security-Policy When you want to allow inline scripts or styles on a page that uses CSP, there two much better options: nonce or hash What else does unsafe-inline allow? Besides just allowing inline script tags, unsafe-inline also allows all of the JavaScript event handlers to execute, for example code like this:
How to avoid unsafe-inline in Content Security Policy (CSP)? Avoid ‘unsafe-inline’ value in script-src directive to increase the protective capability of CSP Try not to write inline-javascript Always write it in a js file If using ‘unsafe-inline’ then don’t forget to assign the nonce value to both the CSP header and inline-javascript
Removing Inline Resources - Csper What if I can't remove all the inline content? One other option is to run Content-Security-Policy in Report-Only mode, and just monitor for naughtiness The reports will still be fired for all the existing inline content, but also for any XSS's