'inline' is also treated as a separate source. If your policy is 'self' that onl...

porges on Jan 23, 2014 | parent | context | favorite | on: HTTP Security headers you should be using

'inline' is also treated as a separate source. If your policy is 'self' that only means same-origin code is allowed to run, and inline JS is disabled.