It's also worth noting that 'unsafe-inline' in CSP is commonly used to support older browsers, and a nonce subsequently disables the unsafe directive for modern

It's also worth noting that 'unsafe-inline' in CSP is commonly used to support older browsers, and a nonce subsequently disables the unsafe directive for modern browsers that support it. It can be hard to read a policy visually and see if the directive actually applies. (The same thing happens with 'strict-dynamic' and allowing all HTTP(S) URIs -- 'strict-dynamic' disables the URIs when supported.) ref: https://csp.withgoogle.com/docs/strict-csp.html#example https://csp.withgoogle.com/docs/strict-csp.html#example