Following is a CSP policy, for example derived sample response headers.

The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' directives are also used next 'self'.

Will this 'unsafe-inline' / 'unsafe-eval' be used by all white-listed domains including 'self' or is it only for 'self' domain?

script-src https://test1dummy.com/
 'self' 'unsafe-inline' 'unsafe-eval'

1 Answer 1


That CSP directive will allows the use of inline resources, such as inline <script> elements, javascript: URLs, inline event handlers, and inline <style> elements, plus also allows the use of eval() and similar methods for creating code from strings.

So... don't bother using CSP. You've just allowed all the bad guys in anyway.

If you change that construct to

content-security-policy: 'script-src' https://test1dummy.com/ https://www.google.com/ 'self' https://test2dummy/ https://test3dummy

then you've restricted scripts to run from code files on the site itself, plus any of the whitelisted URLS.

<script type="text/javascript" src="https://test1dummy.com/testscript.js"></script> 

is valid, because test1dummy.com is whitelisted.

<script type="text/javascript" src="https://mydomain.com/testscript2.js"></script> 

is valid - but only if mydomain.com is the domain that the CSP headers are running on. If not, then that won't be valid.

<script type="text/javascript">document.write("Hello admin");</script>

This would NOT be valid, now that we've removed the 'inline-unsafe' option.

If we have a script which is running on a whitelisted domain, such as

<script type="text/javascript" src="https://test1dummy.com/testscript.js"></script> 

and that script itself ends up modifying the DOM and injecting inline script, then that will also be caught by your construct and blocked. And so on, ad-infinitum. Tracking down the script that adds the inline JavaScript is a lot of fun with CSP headers. In the same way, if you leave the 'unsafe-inline' option in place, any of your whitelisted domains can add inline code to your page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .