Auth & Client-Side Security
medium Severity
Free Check
Inline Script Analysis & Event Handlers
Audits raw <script> blocks and inline event attributes (onclick, onload) that bypass CSP nonce protections.
Why It Matters
Using inline script blocks prevents the deployment of a strict CSP and increases vulnerability to injection.
How We Check This
We parse the HTML DOM for script tags lacking nonce attributes and elements with on* event handlers.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
Move all inline scripts into external .js files or supply cryptographic nonces
Frequently Asked Questions
Why are inline scripts flagged in security audits?
Because an attacker injecting HTML cannot be distinguished from a legitimate inline script unless cryptographic nonces are enforced.