Content Security Policy settings

[GewoonR]

Hi there,

Try to make a Content Security Policy using the wizard at a great website called report-uri.com. This wizard will show you the detected items on a website. I let it ran for a week and the detected items contained also a lot of 'unsafe-inline', 'unsafe-eval' directives:

• default-src 'unsafe-inline'

• script-src-attr 'unsafe-inline'

• script-src-elem 'unsafe-inline'

• script-src 'unsafe-eval'

• script-src 'unsafe-inline'

• style-src-attr 'unsafe-inline'

• style-src-elem 'unsafe-inline'

• style-src 'unsafe-inline'

In my opinion the website will remain vulnerable when putting these in the CSP. Are there specific directives that should have the 'unsafe-inline' or 'unsafe-eval' directives for Joomla 4 to work properly?

Thanks in advance!