Answers.Body: <p>I implemented this recently and what I ended up doing is return the content security headers using PHP. Depending on the request path (is it a CP URL or not?), we send CSP headers with unsafe-inline and unsafe-eval or not.</p>
  
  <p>Of course, the CP is still unsecured, but what you can do is to specify a custom domain for the CP in your configuration (using the "<a href="https://craftcms.com/docs/config-settings#baseCpUrl" rel="noreferrer">baseCpUrl</a>" key). Something like "admin.yourwebsite.com" that only certain users can access (using IP filtering for example).</p>
  
  <p>It is still not a perfect solution, but we cannot do anything at the CP level unfortunately. I hope this will not be an issue anymore in Craft 3.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-04-09T18:59:21.293Z
Answers.Text: Does Craft 3 avoid this issue with `unsafe-inline`?
Answers.UserDisplayName: David Oliver
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-06T15:53:53.080Z
Answers.LastActivityDate: 2017-11-06T15:53:53.080Z
Answers.UserDisplayName: kant312
Body: <p>On Craft 2.x, is it a known limitation that we must allow <code>unsafe-inline</code> for <code>script-src</code> in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it.</p>
  
  <p>...Trying to get a high grade on <a href="https://observatory.mozilla.org/" rel="noreferrer">Mozilla Observatory</a> :)</p>
  
Tags: <security>
Title: Content Security Policy CSP
ThreadText: # Content Security Policy CSP
  
  (Asked by: username_0 on 2017-11-06)
  
  On Craft 2.x, is it a known limitation that we must allow `unsafe-inline` for `script-src` in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it.
  
  ...Trying to get a high grade on [Mozilla Observatory](https://observatory.mozilla.org/) :)
  
  **Tags:** security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-11-06. Score: 5 | Accepted answer
  
  I implemented this recently and what I ended up doing is return the content security headers using PHP. Depending on the request path (is it a CP URL or not?), we send CSP headers with unsafe-inline and unsafe-eval or not.
  
  Of course, the CP is still unsecured, but what you can do is to specify a custom domain for the CP in your configuration (using the "[baseCpUrl](https://craftcms.com/docs/config-settings#baseCpUrl)" key). Something like "admin.yourwebsite.com" that only certain users can access (using IP filtering for example).
  
  It is still not a perfect solution, but we cannot do anything at the CP level unfortunately. I hope this will not be an issue anymore in Craft 3.
  
  > **Comments:**
  > **username_2**: Does Craft 3 avoid this issue with `unsafe-inline`?  
  
  ---
  
  