Conversation around: how to set content-security-policy header read and noted

https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work.

My question is that when I use a standard Ajax form with CSP enabled to default, I get the following upon clicking the submit button.

"Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'" Either the 'unsafe-inline' keyword, a hash ([redacted]), or a nonce ('nonce-...') is required to enable inline execution."

How can I add either a hash or a nonce to Ajax forms?

Do all Drupal 7 websites require unsafe-inline for any WYSIWYG fields to work? Is that likely to be fixable?

  • AFAIK, AJAX forms don't use inline scripts themselves and should work just fine, so I'm not sure why you would be receiving a console error when clicking submit. Using the report-uri directive and adding the 'report-sample' property to your script-src directive may provide more info on what is being blocked.
    – gapple
    Apr 7, 2019 at 15:47

1 Answer 1


script-src 'unsafe-inline' is required by CKEditor 4 included in Drupal 8 core, so a newer WYSIWYG editor may not require it. Drupal 9 will hopefully include CKEditor 5, which will not require 'unsafe-inline'. CSP Level 3 also introduces the script-src-attr and script-src-elem directives, which can be used to allow only scripts in element attributes and not <script> elements, which will enable CKEditor 4 to work and reduce risk.

Drupal 7 also requires inline scripts be allowed for drupalSettings, though there is a patch available.

Hashes and nonces have some downsides and challenges

  • CSP Level 2 only allows hashes on inline <script> elements, not element attributes like onclick. CSP Level 3 introduces 'unsafe-hashes' to allow hashes for attributes, but it can't really be used at this time because of a lack of browser support.
  • CKEditor 4 would require a 1.5KB CSP header for all of the hashes it would require.
  • Nonces are only applicable to <script> elements.
  • Nonces must be regenerated on each page load, preventing the page cache or other front-end caches from being able to cache the page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.