title: What does CSP protect us if allowing unsafe-inline
body: <p>Currently I'm defining Content Security Policy (CSP) as below;</p>
  
  <pre><code>Header set Content-Security-Policy: "default-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
  </code></pre>
  
  <p>Considering the CSP definition above, I have a challenge with inline JavaScript as it can be over-ridden at any time.</p>
  
  <p>What is the use of <code>unsafe-inline</code> if it virtually does not protect?</p>