# Removing unsafe-inline

**URL:** <https://discourse.dojo.io/t/removing-unsafe-inline/275>\
**Category:** Dojo 1.x users\
**Created:** [September 6, 2018, 4:07pm UTC](https://discourse.dojo.io/t/removing-unsafe-inline/275 "2018-09-06T16:07:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![christian](https://avatars.discourse-cdn.com/v4/letter/c/b2d939/32.png) [@christian](https://discourse.dojo.io/u/christian)\
**Post date:** [September 6, 2018, 4:07pm UTC](https://discourse.dojo.io/t/removing-unsafe-inline/275/1 "2018-09-06T16:07:17Z")

</div>

I wondered if it was possible to use Dojo 1.x without unsafe-inline being present within the CSP?  
I’ve tried removing this, however I get errors within dom-construct, \_WidgetBase etc.

Is there anything we can do to alleviate these issues?

---

<div class="post-metadata">

**Author:** ![schallm](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@schallm](https://discourse.dojo.io/u/schallm)\
**Post date:** [September 10, 2018, 2:28pm UTC](https://discourse.dojo.io/t/removing-unsafe-inline/275/2 "2018-09-10T14:28:59Z")

</div>

Here is the tightest we have been able to lock things down.

```
		If DoesFileUpload(controller, action) Then
			scriptSrcExtra = "'unsafe-inline'"
			imageSrcExtra = "data:"
		End If
		response.AddHeader(
			"Content-Security-Policy",
				"default-src 'none';" +
				"font-src data:;" +
				"object-src 'self';" +
				$"script-src 'self' 'unsafe-eval' {scriptSrcExtra};" +
				"connect-src 'self';" +
				$"img-src 'self' {imageSrcExtra};" +
				"style-src 'self' 'unsafe-inline';" +
				"frame-src 'self';" +
				"manifest-src 'self';" +
				"report-uri /api/CspReport"
			)
```