How do I use a Content Security Policy to stop inline scripts?
Asked on Sep 24, 2025
Answer
To stop inline scripts using a Content Security Policy (CSP), you need to configure the CSP to disallow 'unsafe-inline' and use nonces or hashes for any inline scripts you wish to permit.
<!-- BEGIN COPY / PASTE -->
Content-Security-Policy: script-src 'self' 'nonce-<random-value>';
<!-- END COPY / PASTE -->Additional Comment:
- Using a nonce (number used once) allows specific inline scripts to run by matching the nonce value.
- Ensure that each nonce is unique per request to maintain security.
- Hashes can also be used as an alternative to nonces for specific inline scripts.
✅ Answered with Security best practices.
Recommended Links: