I was recently testing for Clickjacking and when I opened developer tools, I was warning

Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified

Do you guys think it is possible to bypass it, If yes can you share me the further information?

enter image description here

Thank You.

1 Answer 1


This warning just means that a script was already explicitly trusted by nonce-source or hash-source and that the additional unsafe-inline makes no sense in this context - and thus will be ignored. The warning does not indicate that any bypass could be possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .