I am reviewing the Content-Security-Policy headers set in one of our webservers and I see this is how it is set (where 'example.com' is our trusted website).
Content-Security-Policy: "default-src 'self'; script-src 'self' data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' *.example.com; font-src *; connect-src 'self' *example.com"
My questions are:
1) Won't whitelisting
unsafe-eval kind of defeat the whole CSP?
script-src directive and there-by defeat the whole purpose of CSP? Eg:
I went through this question here and going by the answers, it does look like the above CSP is not good.