内容安全策略和mod_pagespeed evals

Question

I'm trying to set up CPS rules for my website. Also I try to prevent using 'unsafe-eval' for scripts but I found out that mod_pagespeeds uses it a lot. Here is some code generated by mod_pagespeeds on webpage:

<script>eval(mod_pagespeed_N_OeYaMDDO);</script> <script>eval(mod_pagespeed_vvygFO_kog);</script>

How to fix this?

Also some of plugins installed on the website (based on wordpress) like to add inline scripts. Is there way to fix this too?

And the last question. How bad is an idea to use 'unsafe-inline' for styles? Google gives an advice to use inline styles for fast page loading but CPS says it bad practice. Whome to believe?

Answer 1

From the documentation:

As of 1.13.35.1 PageSpeed is able to adapt its optimizations according to any Content Security Policies specified in the response headers. In this release you need to opt-in into this feature, future releases may turn it on by default.

To opt-in configure the following: ModPagespeedHonorCsp on

I enabled the above on my server and removed unsafe-eval as an allowed CSP script source. mod_pagespeed, however, seemed to ignore that and still use evals. The Chrome dev tools console showed quite a few errors. I documented the problem here:

https://groups.google.com/forum/#!topic/mod-pagespeed-discuss/65Emhm1O1xs