Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was recently testing for Clickjacking and when I opened developer tools, I was warning
Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified
Do you guys think it is possible to bypass it, If yes can you share me the further information?
Thank You.
This warning just means that a script was already explicitly trusted by nonce-source or hash-source and that the additional unsafe-inline makes no sense in this context - and thus will be ignored. The warning does not indicate that any bypass could be possible.
