CSP style-src: 'unsafe-inline' in a landing page

Question

I use the Webflow tool to set up my website. I export the code to host it on my server.

I have set up the Content-Security-Policy header.

Problem : most of the styles are inline. I can't add the hash for all of them, there are too many ...

Is it so dangerous to put unsafe inline on style-src ?

Note that this is a 99.9% static site (just a contact form).

Thank you for your help!

Answer 1

The dangers of 'unsafe-inline' in style-src are discussed here: https://scotthelme.co.uk/can-you-get-pwned-with-css/

If you can restrict the rest of your CSP, the dangers will be limited, but there will always be someone who disagrees. If it is technically possible you could use nonces, as you could use the same nonce for all tags, but change it on every pageload. It seems like you don't want or can extract all the CSS to a separate file, which would of course be the simplest solution.