Unsafe inline style

security.headers.unsafe_inline_style

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, response headers

What the rule checks

Scope. Applies to responses with at least one enforced Content-Security-Policy header; without one (or with only a report-only policy) there is no policy to judge.

Expectation. Fails when the effective style source list (style-src, else default-src) allows 'unsafe-inline' without a nonce or hash; with one it is ignored and passes. Without an enforced CSP the check does not apply (that is the missing_header finding).

Source. CSP Level 3, 'Directives' (script-src, style-src and object-src fall back to default-src; base-uri and frame-ancestors have no fallback), 'Does a source list allow all inline behavior for type?' ('unsafe-inline' is ignored next to a nonce or hash), 'Policy lists' (every policy is enforced); Google CSP Evaluator

Detection: analyze_security; needs network.

Failing example

The check reports a violation here. Corpus case csp_permissive. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src *; script-src 'unsafe-inline' 'unsafe-eval' *; style-src 'unsafe-inline'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Passing example

The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.