QUESTION have you added a content security policy to your website?

[craiga]

I'm working on a website where we require the implementation of content security policy (csp). It's going ok so far but I have an issue with the inline styles that are being added (presumably via the ckeditor).

Has anyone else added a csp to any of their GS websites? I would be interested in seeing how you dealt with this issue.

Ideally without using unsafe-inline if possible. I know I can use a nonce or hash but was unsure where the inline styles were being generated.

Thanks