4 ms·

> If you really want to, you can put some JS right in the HTML file, immediately following the elements it is going to operate upon, changing the display of the

> If you really want to, you can put some JS right in the HTML file, immediately following the elements it is going to operate upon, changing the display of the elements before they are even rendered to the screen. This is indeed a cool trick I have seen in use in the wild. Can it work with CSP, however?

PinkPigeon 5y ago
That would have been my first question as well. It can work, if you specifically add the hash of that bit of JS to script-src or use the nonce based approach (I never figured that one out). Otherwise it's unsafe-inline, at which point you may aswell not bother ;)
- ezekg 5y ago
  On latest Chrome, using hashes for scripts now requires 'unsafe-hashes' to be specified in your CSP.
  - ezekg 5y ago
    Correction: this only applies event handlers, e.g. onclick='someFunction()'
genuine_smiles 5y ago
What’s “CSP”?
- detaro 5y ago
  Content-Security Policy, a header to define allowed script sources etc.