Weak CSP — removing unsafe-inline, wildcards, and other escape hatches

Real-world risk

Permissive keywords (e.g. unsafe-inline, wildcards) weaken CSP so attackers can still run script.

Fix steps (in order)

1. Remove unsafe-inline / unsafe-eval for script-src; use nonces or hashes for required inline script.
2. Replace * sources with explicit host allowlists.

Example configurations

Patterns for common stacks. Set headers at your CDN, load balancer, or origin as appropriate.

• nginx (tighten script-src) · nginx

  # Drop 'unsafe-inline' / wildcards in production; use nonces or hashes for any inline script.
  add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;

• Express (helmet) · typescript

  import helmet from "helmet";
  app.use(
    helmet.contentSecurityPolicy({
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'"],
        objectSrc: ["'none'"],
      },
    }),
  );

• Apache · apache

  # Replace permissive policy with explicit hosts and no unsafe-inline where possible.
  Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"