Disabling CSP altogether is not recommended, but you do have a security impact by allowing inline styles. For example, you could use the following policy:
script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' http: https: 'report-sample';
style-src 'self' 'nonce-rAnd0m123';
This would use
'strict-dynamic' for scripts, and would require you to add a nonce to every tag where Adobe Fonts wants to inject their webfonts. This may or may not be possible, depending on how Adobe Fonts works.
What is the worst that could happen?
If you really have to allow
'unsafe-inline' in your
style-src directive, then you may open yourself up to CSS Injection, which may lead to stolen credentials. Of course, CSP should not your only defense against such things, so please don't see it as such.
What about the CSP directive on their website?
Adobe suggests the following CSP directive:
script-src 'self' use.typekit.net;
style-src 'self' 'unsafe-inline' use.typekit.net;
img-src 'self' p.typekit.net;
The focus on whitelists suggests that this directive was added back when CSP was still very young and only whitelist-based approaches were possible. By using the
'nonce-' approach, you cam ensure that only the inline scripts loaded in specific locations are allowed.