Skip to content
Header Hawk

script-src-attr

script-src-attr covers inline event handler attributes - onclick, onerror, onsubmit and the rest - and nothing else.

It is the cheapest useful tightening in CSP. Almost no modern codebase needs inline handlers, and script-src-attr 'none' turns an entire class of injected markup into a violation report without touching the scripts you do ship.

Syntax

Section titled “Syntax”
Content-Security-Policy: script-src-attr 'none';
Content-Security-Policy: script-src-attr <source-expression-list>;

What it controls

Section titled “What it controls”
  • Inline event handler attributes on any element.

What it does not control

Section titled “What it does not control”
  • <script> elements and their URLs - see script-src-elem.
  • eval() and other dynamic code execution, which stay with script-src.

Fallback

Section titled “Fallback”

If script-src-attr is absent, the browser consults script-src, and then default-src. The full chain is script-src-attr → script-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: script-src-attr 'none'
  • Inline handlers have a direct replacement - addEventListener - so 'none' is achievable on almost any codebase.
  • 'unsafe-hashes' plus a hash of each handler is the migration path when a template you do not own emits them. It is a waypoint, not a destination: the hash covers that exact handler text, so any edit to it is a new hash.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

The replacement for every inline handler:

document.getElementById("buy").addEventListener("click", checkout);

Blocked

Section titled “Blocked”

Under script-src-attr 'none', the handler never runs:

<button id="buy" onclick="checkout()">Buy</button>

Browser support

Section titled “Browser support”
  • Baseline: widely available across browsers since December 2022.
  • 'unsafe-hashes' applies here and is the only way to allow a specific handler by hash.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective script-src-attr
effectiveDirective script-src-attr
blockedUri inline
Issue title script-src-attr inline script (a1b2c3d4)
  • blockedUri is always inline - there is no URL to report. What distinguishes one issue from another is the code sample, so HeaderHawk keys the issue on a hash of it.
  • Without 'report-sample' in the policy the browser sends no sample, every handler hashes to the same unknown, and the whole page collapses into one issue. Add 'report-sample' to script-src-attr before you start triaging these.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.