Inline scripts and styles are just a kind of language (CSS/Javascript) embedded in another langauge (HTML). Why are them not allowed by default under content security policy?


So why not allow inline JS? Because that would negate the whole benefit of a CSP! The goal is to stop XSS - injection of eg. JS into a HTML page. Since it is near impossible to distinguish between scripts that are legitimately mixed into HTML and scripts that have been maliciously injected into HTML, the best way to stop XSS is to simply not allow any inline scripts. Yes, it is "just a kind of language embedded in another", but that mix risk being toxic.

So why block it by default? Because the philosophy is to block everything by default, and then list what should be allowed. Whitelisting instead of blacklisting decreases the risk of something slipping through accidentally.


Content-Security-Policy is used to prevent against script injection (XSS). If inline script would be allowed an attacker could still use XSS to inject script into the existing page. That's why it is denied by default and anybody using inline script should either remove it or limit it to protected areas or protect the script against modifications by using nonces or hashes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.