Replace 'unsafe-inline' scripts with nonces or hashes on Cloudflare
Why it matters
With 'unsafe-inline' any script an attacker manages to inject into the page runs, which cancels most of what a CSP protects. Nonces or hashes let only the inline scripts you wrote run.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- A Transform Rule sends a fixed value, so it cannot carry a per-response nonce. Generate the nonce and header in your application, or in a Cloudflare Worker that rewrites the HTML.
- With the header produced at the origin, remove any Transform Rule that sets Content-Security-Policy (Set static would overwrite the origin's nonce), then roll out report-only first and enforce after.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.