Apply Policy

Inline Script Blocked

The inline script row is blocked.

highlighted = computed this step

The inline script row is blocked

The table models inline script as not being self.

inline script blocked\text{inline script blocked}
Inline scriptThe script decisions and empty response body are recomputed from the pinned CSP response.Inline script - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty

The decision contrasts with the app script

One row is allowed, and the inline row is blocked.

allowed versus blocked\text{allowed versus blocked}
Inline scriptThe script decisions and empty response body are recomputed from the pinned CSP response.Inline script - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty

The response still sends no body

Content-Length is 0 in this pinned response.

body bytes=0\text{body bytes}=0
Inline scriptThe script decisions and empty response body are recomputed from the pinned CSP response.Inline script - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty

Summary

The inline script row is blocked by the pinned self-only policy.

inline decision checked\text{inline decision checked}
Inline scriptThe script decisions and empty response body are recomputed from the pinned CSP response.Inline script - app.example allows self scripts and blocks inline scriptsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/pageparsedrequest lineversionHTTP/1.1parsedheaderHostapp.exampleexactheaderContent-Security-Policydefault-src 'self'; script-src 'self'exactdirectivedefault-srcselfselfdirectivescript-srcselfselfscript decision/app.jsallowedsame originscript decisioninline scriptblockednot selfstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostapp.exampleexactcheckstatus200 OKokcheckdefault-srcselfselfcheckscript-srcselfselfchecksame-origin scriptallowedallowedcheckinline scriptblockedblockedchecksent body bytes0empty