Overview

style-src-attr is a granular directive that controls only the CSS in inline style attributes on elements (e.g., <div style="...">). It does not govern stylesheets or <style> blocks. When omitted it falls back through style-src → default-src.

Details

Inline style attributes can be a channel for style-injection attacks (e.g., exfiltrating data via background:url() or overlaying UI to induce clickjacking). Setting style-src-attr 'none' blocks execution of injected inline styles, reducing this risk; conversely, 'unsafe-inline' permits inline style attributes.

A practical caveat: much UI code assigns dynamic styles via element.style.xxx or the style attribute. Locking style-src-attr to 'none' can break layouts that rely on these, so refactor to class toggling before applying.

Syntax

Content-Security-Policy: style-src-attr 'none'

Notes

• style-src-attr 'none' suppresses style injection and UI-redressing via inline style attributes.
• If code sets dynamic styles via element.style, refactor to class toggling before applying.
• The fallback order is style-src-attr → style-src → default-src.

Related directives