What CSP is safer - style-src 'none' or style-src 'unsafe-inline'

user_7763383 0
Viewed 941

I am struggling to fully understand style-src 'none'. Based on the naming, it sounds like it would be restrictive or does it mean that there are no rules and you can do whatever you want?

Same question for script-src 'none' in the unlikely situation where it acts differently.

Side-note - what is the best CSP if you are using the library styled-components (everything is injected as inline with this library)?

EDIT:

I have read before the description of none from mdn.

'none'
Refers to the empty set; that is, no URLs match. The single quotes are required.

What does this mean? Does this mean that it does not block styles/scripts or the opposite?

content-security-policy styled-components header security html
1 Answers

A policy source of 'none' is the MOST restrictive; it means NO hosts are valid.

From the link I cited above:

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Let's consider a page located at http://example.com/signup.html. It uses the following policy, disallowing everything but stylesheets from cdn.example.com.

Content-Security-Policy: default-src 'none'; style-src cdn.example.com; report-uri /_/csp-reports
user_4211950
Related