Checks

CSP allows unsafe-inline

Content-Security-Policy includes 'unsafe-inline', so the browser may run inline scripts or styles.

Why it matters

unsafe-inline weakens the main XSS protection CSP is for. An injected <script> or event handler is allowed by the policy.

What to do

Remove 'unsafe-inline'. Allow specific inline scripts with a nonce or a hash instead.

Reference

CSP Level 3 defines the directives and source lists this check evaluates.

W3C CSP Level 3