'unsafe-inline' 'unsafe-eval' 的 CSP 安全使用

Question

I'm backend developer helping with a web server deployment for a frontend team, while I was researching vulnerabilites I came across Content Security Policy, if I set up the CSP header this "Content-Security-Policy: default-src 'self' data: {own_domain_1} {own_domain_2}", the website doesn't work, the frontend team tells me that adding 'unsafe-inline' and 'unsafe-eval' will not pose a threat since the domains where the data is being loaded from are our own but I have not come across any kind of documentation that make that claim, is it true?, and if not, can you point me to the documentation so I can bring it to my superiors. Thanks in advance.

Answer 1

It's definitely better if you can avoid unsafe-inline and unsafe-eval.

The usual cause for seeing/needing unsafe-inline is having inline styles or style tags on the page. Move all that to your css files and use only classes.

And unless there is an EXTREMELY STRONG CASE FOR IT , you should not permit unsafe-eval. And even if you find this extremely strong case, you should ask yourself whether this feature is truly necessary.

Both of these open serious vulnerabilities, not just from 3rd party users, but from your own employees - don't just trust 'em because they tell you to. Script injection is a serious security concern.