ntent-Security-Policy: style-src 'sha256-ozBpjL6dxO8fsS4u6fwG1dFDACYvpNxYeBA6tzR+FY8='
    

When generating the hash, don't include the [ ` <style> ` ](/en-
US/docs/Web/HTML/Element/style) tags and note that capitalization and
whitespace matter, including leading or trailing whitespace.

html

    
    
    <style>
      #inline-style {
        background: red;
      }
    </style>
    

###  Unsafe style expressions

The ` 'unsafe-eval' ` source expression controls several style methods that
create style declarations from strings. If ` 'unsafe-eval' ` isn't specified
with the ` style-src ` directive, the following methods are blocked and won't
have any effect:

  * [ ` CSSStyleSheet.insertRule() ` ](/en-US/docs/Web/API/CSSStyleSheet/insertRule)
  * [ ` CSSGroupingRule.insertRule() ` ](/en-US/docs/Web/API/CSSGroupingRule/insertRule)
  * [ ` CSSStyleDeclaration.cssText ` ](/en-US/docs/Web/API/CSSStyleDeclaration/cssText)

##  Specifications

Specification  
---  
[ Content Security Policy Level 3  
#  directive-style-src  ](https://w3c.github.io/webappsec-csp/#directive-
style-src)  
  
##  Browser compatibility

BCD tables only load in the browser  with JavaScript enabled. Enable
JavaScript to view data.

##  See also

  * [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
  * [ ` style-src-elem ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-elem)
  * [ ` style-src-attr ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-attr)
  * [ ` Link ` ](/en-US/docs/Web/HTTP/Headers/Link) header 
  * [ ` <style> ` ](/en-US/docs/Web/HTML/Element/style) , [ ` <link> ` ](/en-US/docs/Web/HTML/Element/link)
  * [ ` @import ` ](/en-US/docs/Web/CSS/@import)
  * [ ` CSSStyleSheet.insertRule() ` ](/en-US/docs/Web/API/CSSStyleSheet/insertRule)
  * [ ` CSSGroupingRule.insertRule() ` ](/en-US/docs/Web/API/CSSGroupingRule/insertRule)
  * [ ` CSSStyleDeclaration.cssText ` ](/en-US/docs/Web/API/CSSStyleDeclaration/cssText)

##  Help improve MDN

Was this page helpful to you?

Yes  No

[ Learn how to contribute
](https://github.com/mdn/content/blob/main/CONTRIBUTING.md "This will take you
to our contribution guidelines on GitHub.") .

This page was last modified on  Aug 28, 2023  by  [ MDN contributors ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src/contributors.txt) .

[ View this page on GitHub
](https://github.com/mdn/content/blob/main/files/en-
us/web/http/headers/content-security-policy/style-src/index.md?plain=1
"Folder: en-us/web/http/headers/content-security-policy/style-src \(Opens in a
new tab\)") â¢  [ Report a problem with this content
](https://github.com/mdn/content/issues/new?template=page-report.yml&mdn-
url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FContent-Security-Policy%2Fstyle-
src&metadata=%3C%21--+Do+not+make+changes+below+this+line+--%3E%0A%3Cdetails%3E%0A%3Csummary%3EPage+report+details%3C%2Fsummary%3E%0A%0A*+Folder%3A+%60en-
us%2Fweb%2Fhttp%2Fheaders%2Fcontent-security-policy%2Fstyle-
src%60%0A*+MDN+URL%3A+https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FContent-Security-Policy%2Fstyle-
src%0A*+GitHub+URL%3A+https%3A%2F%2Fgithub.com%2Fmdn%2Fcontent%2Fblob%2Fmain%2Ffiles%2Fen-
us%2Fweb%2Fhttp%2Fheaders%2Fcontent-security-policy%2Fstyle-
src%2Findex.md%0A*+Last+commit%3A+https%3A%2F%2Fgithub.com%2Fmdn%2Fcontent%2Fcommit%2Febc9954c53b92385b8a99d7be95bd63c789bc029%0A*+Document+last+modified%3A+2023-08-28T23%3A01%3A12.000Z%0A%0A%3C%2Fdetails%3E
"This will take you to GitHub to file a new issue.")

[ MDN logo  ](/)

Your blueprint for a better internet.

  * [ MDN on Mastodon  ](https://mozilla.social/@mdn)
  * [ MDN on X (formerly Twitter)  ](https://twitter.com/mozdevnet)
  * [ MDN on GitHub  ](https://github.com/mdn/)
  * [ MDN Blog RSS Feed  ](/en-US/blog/rss.xml)

##  MDN

  * [ About ](/en-US/about)
  * [ Blog ](/en-US/blog/)
  * [ Careers ](https://www.mozilla.org/en-US/careers