I am setting security headers for the firebase project, one of them is Content-Security-Policy. The value of it is like this now:
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Since we have scripts that are executed in the index.html file, one of the issues is with the script-src property. It throws the following error now:
it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash, or a nonce ('nonce-...') is required to enable inline execution
I researched the unsafe-inline, unsafe-eval, etc and I found that it's better to not use them. So I am not sure how to solve the issue. Could you please advise?
