Hacker News Reader

> If you really want to, you can put some JS right in the HTML file, immediately following the elements it is going to operate upon, changing the display of the elements before they are even rendered to the screen.

This is indeed a cool trick I have seen in use in the wild. Can it work with CSP, however?

View on HN

That would have been my first question as well.

It can work, if you specifically add the hash of that bit of JS to script-src or use the nonce based approach (I never figured that one out).

Otherwise it's unsafe-inline, at which point you may aswell not bother ;)

On latest Chrome, using hashes for scripts now requires 'unsafe-hashes' to be specified in your CSP.

Correction: this only applies event handlers, e.g. onclick='someFunction()'

What’s “CSP”?

Content-Security Policy, a header to define allowed script sources etc.

Reply on news.ycombinator.com