CSP is way too ambitious and complicated for its own good. It's like SELinux for the web. It's one of the best examples of a pursuit of perfection getting in th

CSP is way too ambitious and complicated for its own good. It's like SELinux for the web. It's one of the best examples of a pursuit of perfection getting in the way of what's good enough. What's a CSP one-liner that you can copy and paste into any webpage to prevent execution of all inline scripts, regardless of what external scripts, styles, fonts, and other resources it loads? I suppose it will look something like 'default-src *', but even this most basic usage (and its possible side effects) doesn't seem to be clearly documented in any authoritative guideline. All the documentation is so obsessed with whitelisting this and that CDN, blocking non-https scripts (don't all browsers already do that?), and all sorts of other tricks that they scare away someone who is just looking for some baseline level of protection. If, instead, we just defined a simple header, meta tag, or even an HTML attribute to block run-of-the-mill XSS attacks on a typical webapp or open-source CMS, the Internet might have become a much safer place already.