CSP 'unsafe-inline'

Permits inline script and style. In script-src it negates the policy — unless a nonce or hash is present.

Falls back to

nothing — must be set explicitly

Group

Source keywords

Detail

This is the value that turns a CSP into decoration: it permits exactly the injected inline script CSP exists to block. The critical subtlety is that browsers supporting nonces IGNORE 'unsafe-inline' when a nonce or hash is present in the same directive. A policy containing both is the standard old-browser fallback pattern, not a vulnerability — and a scanner reporting it as one is producing a false positive.

Example

Analyse a full policy → · Generate one →