Remove hashes/nonces when unsafe-inline is set

[Yannik]

I have a quiet complicated CSP, which is optimized for minimal permissions, but for some pages is more open due to third party library requirements (e.g. mapbox).

By default, hashes are set for inline styles, but sometimes, it it necessary to set unsafe-inline because the hashes cannot be precomputed.

In this case, it would be very useful to either a) automatically or b) manually remove the hash/nonce directives, because otherwise unsafe-inline is ignored by the client browser per the CSP spec.

@freekmurze What do you think about this?

[vimalgorasiya]

@freekmurze

I'm aligned with @Yannik's viewpoint regarding CSP implementation in the package. I believe that either automatically removing nonces when unsafe-inline is specified for scripts or providing a method to remove nonce directives would significantly enhance usability and developer friendliness.

Thanks

[freekmurze]

Feel free to submit a PR 👍

[magicyoda]

That would be amazing ! Actual example is using tinymce requiring 'unsafe-inline' for style... https://www.tiny.cloud/docs/tinymce/latest/tinymce-and-csp/

[juliangums]

PR created for this: #132