Using a QR code in the process you described basically just ensures that the user has a cell phone, if I understand it right. So, yes, your suspicion is correct.
The way that apps like Google Authenticator are used is that the QR code is generated one time, when the account is set up (or when the user chooses to enable 2FA). The QR code is a way of sharing ...
Yes, it is worth setting up a CSP anyway. Here are a few benefits:
Many real world XSS vulnerabilities does not allow arbitrarily long payloads. A common technique is then to just have a small payload that loads the big payload from another server. This can be prevented with a CSP.
You can prevent clickjacking with a frame-ancestors directive.
There are ...
I've read around this a fair bit and found plenty of comments
indicating that if I need to apply 'unsafe-inline', the CSP header
really isn't going to do much for me.So my question is; does applying
'unsafe-inline' render CSP more or less pointless?
True, Disallowing inline styles and inline scripts is one of the biggest security wins CSP provides. ...
does applying 'unsafe-inline' render CSP more or less pointless?
Preventing XSS is one of the main benefits of a CSP. If you need to allow inline scripts, that benefit is mostly gone.
But there are still some situations where a CSP can prevent exploitation of issues. Examples:
Clickjacking: a CSP can prevent it
HTML injection: Even if no XSS can be ...