Here is an example of the CSP of accounts.google.com:
content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
The "nonce" means it will add a whitelist to a script that has the unique ID of "DanEwkxkS1rktq35Z1hVcg" (if I understand correctly). But after that, they allow use of inline script tags as well as the eval() function (through "unsafe-inline" and "unsafe-eval" respectively). So what's the point of giving a specific whitelist to a script with ID "DanEwkxkS1rktq35Z1hVcg", but also allowing all inline scripts? Do I fundamentally misunderstand something about how CSP works?