What does CSP protect us if allowing unsafe-inline
<p>Currently I'm defining Content Security Policy (CSP) as below;</p>

<pre><code>Header set Content-Security-Policy: "default-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
</code></pre>

<p>Considering the CSP definition above, I have a challenge with inline JavaScript as it can be over-ridden at any time.</p>

<p>What is the use of <code>unsafe-inline</code> if it virtually does not protect?</p>