The Content Security Policy allows inline or eval'd scripts.

CSP_UNSAFE_INLINE · Severity: Info

• InfoCSP_UNSAFE_INLINE

  The Content Security Policy allows inline or eval'd scripts.

  The script-src directive (or default-src, when there is no script-src) allows 'unsafe-inline' without a nonce or hash, or allows 'unsafe-eval'. Injected inline scripts can then run, which removes most of the protection the policy gives against cross-site scripting.

  Recommendation: Move inline scripts to files or allow them with nonces or hashes, and drop 'unsafe-eval' once no code needs eval().

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

Related findings

• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.

All findings