4 ms·
> There's no way to whitelist inline code That's not completely true - the nonce attribute (specify a nonce in the CSP header, have nonce=that on every script
by jacobparker 11y ago
> There's no way to whitelist inline code
That's not completely true - the nonce attribute (specify a nonce in the CSP header, have nonce=that on every script tag) or by sending the hashes of the inline scripts upfront in the CSP header.
It doesn't give you inline code in attributes (e.g. onclick) but it's a big help for migrating.
- JoshTriplett 11y agoAh. I hadn't found that in Mozilla's CSP documentation. Thanks.
- Scott_Helme_ 11y agoI'm going to be doing some blogs in the coming weeks on how to use hashes and nonces to whitelist inline script. Hopefully, this will make introducing CSP a little easier. I also have some tools in the making that will help in this regard too.