CSP style-src
Where stylesheets may come from.
- Falls back to
default-src- Group
- Fetch directives
Detail
Inline style is a much smaller risk than inline script — the main concern is CSS-based data exfiltration through attribute selectors, which is real but narrow. Most sites end up with 'unsafe-inline' here because component libraries inject style attributes. That is a defensible trade-off in a way it never is for script-src.
Example
style-src 'self' 'unsafe-inline'