... which means if you use something like React and do not inject HTML or use innerHTML or other eval-type junk then you don&#x27;t actually need to worry much about allowing inline CSS or inline JavaScript.<p>Some of CSP&#x27;s protections are there to protect crap web developers from blowing their feet off. Unfortunately there are enough of these on the web platform that having inline CSS and inline JavaScript off by default is a good idea. The &#x27;unsafe&#x27; in &#x27;unsafe-inline&#x27; means &#x27;I know what I am doing.&#x27;