Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline script hashes and the inability to allow unsafe-inline and unsafe-eval per third-party domain. Also, managing the CSP would involve a developer with access to code and cannot be offloaded easily to non-developers (however, wrong this approach may seem, it seems to be what most companies prefer).
The CSP attribute
strict-dynamic was introduced to solve the problem of CSP becoming essentially unmanageable.
The idea of
OneScriptToLoadThemAll.js, but for the purpose of brevity, I'll refer to it as the "root script", as you can imagine the trust propagated by these scripts like a tree.
What does the root script do?
The root script's goal is to load every subsequently used script. This script can also be used to add event listeners (e.g.
onclick, etc.) to objects, and these would be trusted as well?
What can I do if I really hate CSP?
You can choose not to use it. It's not considered best practice though. If your code relies heavily on adding inline code originating from countless places, then you should refactor your code instead.