<p>I implemented this recently and what I ended up doing is return the content security headers using PHP. Depending on the request path (is it a CP URL or not?), we send CSP headers with unsafe-inline and unsafe-eval or not.</p>

<p>Of course, the CP is still unsecured, but what you can do is to specify a custom domain for the CP in your configuration (using the "<a href="https://craftcms.com/docs/config-settings#baseCpUrl" rel="noreferrer">baseCpUrl</a>" key). Something like "admin.yourwebsite.com" that only certain users can access (using IP filtering for example).</p>

<p>It is still not a perfect solution, but we cannot do anything at the CP level unfortunately. I hope this will not be an issue anymore in Craft 3.</p>

CC BY-SA 3.0
2018-04-09T18:59:21.293Z
Does Craft 3 avoid this issue with `unsafe-inline`?
David Oliver
CC BY-SA 3.0
2017-11-06T15:53:53.080Z
2017-11-06T15:53:53.080Z
kant312
<p>On Craft 2.x, is it a known limitation that we must allow <code>unsafe-inline</code> for <code>script-src</code> in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it.</p>

<p>...Trying to get a high grade on <a href="https://observatory.mozilla.org/" rel="noreferrer">Mozilla Observatory</a> :)</p>

<security>
Content Security Policy CSP
# Content Security Policy CSP

(Asked by: username_0 on 2017-11-06)

On Craft 2.x, is it a known limitation that we must allow `unsafe-inline` for `script-src` in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it.

...Trying to get a high grade on [Mozilla Observatory](https://observatory.mozilla.org/) :)

**Tags:** security


---

## 1 answers

### Answer by username_1 on 2017-11-06. Score: 5 | Accepted answer

I implemented this recently and what I ended up doing is return the content security headers using PHP. Depending on the request path (is it a CP URL or not?), we send CSP headers with unsafe-inline and unsafe-eval or not.

Of course, the CP is still unsecured, but what you can do is to specify a custom domain for the CP in your configuration (using the "[baseCpUrl](https://craftcms.com/docs/config-settings#baseCpUrl)" key). Something like "admin.yourwebsite.com" that only certain users can access (using IP filtering for example).

It is still not a perfect solution, but we cannot do anything at the CP level unfortunately. I hope this will not be an issue anymore in Craft 3.

> **Comments:**
> **username_2**: Does Craft 3 avoid this issue with `unsafe-inline`?  

---

