3.4.3.2 Types of CSP Violations

Learn about types of CSP violations.

CSP violations types for 'unsafe-inline' include:

  1. Inline Script Tag: Occurs when an inline <script> tag does not have a valid nonce.

    <script>
        console.log('This script will be blocked by CSP because it lacks the correct nonce.');
    </script>
  2. 1. Inline Style Attribute: Happens when the style attribute is used directly on an HTML element.

    <!-- This inline style will be blocked by CSP -->
    <span style="color: blue;">Text</span>
  3. Inline Style Tag: Similar to script violations but related to <style> tags or inline styles.

    <!-- Blocked if no valid nonce is provided -->
    <style>
      body { background-color: red; }
    </style>
  4. Inline JavaScript Attribute: Triggered when inline JavaScript is used in HTML attributes such as onclick, onmouseover, and so on.

    <!-- This will be blocked by CSP -->
    <button onclick="alert('Clicked!')">Click Me</button>
  5. External Resource Violation: Blocked when a resource (for example, script, style) is loaded from a source not allowed in the CSP header.

    <!-- Blocked if cdn.example.com is not in the script-src directive -->
    <script src="https://cdn.example.com/library.js"></script>