Which mandates &#x27;unsafe-inline&#x27; if you&#x27;re using a content security policy (CSP).<p>&gt;Banning inline script is the biggest security win CSP provides, and banning inline style likewise hardens your application.[1]<p>So which is it? Should we be moving away from inline scripts and CSS, and tightening it up with CSP, or is performance&#x2F;fewer requests more desirable? Also, with HTTP2, the performance issue seems moot.<p>[1]<a href="http:&#x2F;&#x2F;www.html5rocks.com&#x2F;en&#x2F;tutorials&#x2F;security&#x2F;content-security-policy&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.html5rocks.com&#x2F;en&#x2F;tutorials&#x2F;security&#x2F;content-secu...</a>