astro/no-unsafe-inline-scripts

disallow inline <script> without src to encourage CSP-safe patterns

📖 Rule Details

Inline scripts typically require script-src 'unsafe-inline' in your Content Security Policy, increasing XSS risk. Prefer external scripts (src) or safer patterns.

🔧 Options

{
  "astro/no-unsafe-inline-scripts": [
    "warn",
    {
      "allowDefineVars": false,
      "allowModuleScripts": false,
      "allowNonExecutingTypes": ["application/ld+json", "application/json"],
      "allowNonce": false
    }
  ]
}
  • allowDefineVars (default: false): allows inline <script define:vars={...}>. Set to true to allow scripts with define:vars.
  • allowModuleScripts (default: false): allows inline <script type="module">.
  • allowNonExecutingTypes (default includes JSON/JSON-LD): allows non-executing types.
  • allowNonce (default: false): allows inline scripts with a nonce attribute (for CSP nonce deployments).

🔇 When Not To Use It

If your project allows inline scripts (e.g., CSP with nonces), you may disable this rule or adjust options.

📚 Further Reading

🚀 Version

This rule was introduced in eslint-plugin-astro v1.4.0

🔍 Implementation



Edit this page
Back
← Next Page
→