TWA 0217

TWA-0217

Message

"Content-Security-Policy has one or more 'unsafe-inline' policies"

Explanation

The Content-Security-Policy is sent from the web server to the web browser in the HTTP header. The Content-Security-Policy directives allows a stricter protection of the web page content by the web browsed.

The Content-Security-Policy is a field in the header of the HTTP response. The value is a string with internal structure, a list of one or more directives. The unsafe-inline directive allows inline scripts and styles in the web page.

Remediation

Remove all unsafe-inline directives from the Content-Security-Policy in the web server configuration.

Only use the unsafe-inline, if the web application needs the setting. Consider changing the web application to work without unsafe-inline in the Content-Security-Policy.

See

• MDN web docs: Content Security Policy
• OWASP Content Security Policy Cheat Sheet