Conversation

I'm considering changing the grading criteria on

@securityheaders

to allow an A+ grade with a CSP that contains unsafe-inline in the style-src directive. What are your thoughts?

Yes, allow A+
36.9%
No, keep as it is
25.2%
Show results
37.8%

436 votesFinal results

Replying to

and

This is a balancing act, for sure. In my own work I want that A+ rating, it I also want to inline critical-path CSS. Would the new rating assume style tags have a hash or nonce?

Replying to

and

If you have those then you don't need unsafe-inline. Chrome is currently on the path to deprecating HTTP Push. It was and for the time being still is a great replacement for inlining assets like CSS and images. It's especially unfortunate now that there's cache partitioning.

1:55 PM · Feb 23, 2022Twitter Web App