Conversation around: how to set content-security-policy header read and noted
https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work.
My question is that when I use a standard Ajax form with CSP enabled to default, I get the following upon clicking the submit button.
"Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'" Either the 'unsafe-inline' keyword, a hash ([redacted]), or a nonce ('nonce-...') is required to enable inline execution."
How can I add either a hash or a nonce to Ajax forms?
Do all Drupal 7 websites require unsafe-inline for any WYSIWYG fields to work? Is that likely to be fixable?