I'm trying to block all inline styles and style attributes in my app and used nonce for validation. I see in chrome, style tags are getting blocked but not the style attribute. I'm getting the CSP error in the console for the style attribute but the style is getting applied for the element. Can anyone please help me resolving this issue.

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' localhost:3000 unsafe-hashes 'report-sample' 'nonce-7LV1f57teStNOnc3tYd44w=='". Either the 'unsafe-inline' keyword, a hash ('sha256-8f935d27GvUutRyY9yWScUMiFUk4WTdZURISiYfPOeQ='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

module CSP STYLE_SRC = [:report_sample] SCRIPT_SRC = [:report_sample] end

unless Utility.asset_precompile? Rails.application.config.content_security_policy do |policy| policy.script_src *[CSP::SELF_DOMAIN_SRC, CSP::INTERNAL_SRC, CSP::SCRIPT_SRC].flatten().compact policy.style_src *[CSP::SELF_DOMAIN_SRC, CSP::INTERNAL_SRC, CSP::STYLE_SRC].flatten().compact end end