Removing inline javascript and CSS will allow us to remove unsafe sources from our Content Security Policy, which will in turn protect against some injection attacks.
Plus it’s way cleaner.
This includes all text within <script> tags, any event attributes like onclick in a tag, and the style attribute of tags. Elements should instead be identified by class or other attribute and have event handles and styles attached based on those identifiers from separate files (which can be independently checked for integrity)
Removing inline javascript and CSS will allow us to remove unsafe sources from our Content Security Policy, which will in turn protect against some injection attacks.
Plus it's way cleaner.
This includes all text within \<script> tags, any event attributes like onclick in a tag, and the style attribute of tags. Elements should instead be identified by class or other attribute and have event handles and styles attached based on those identifiers from separate files (which can be independently checked for integrity)
Removing inline javascript and CSS will allow us to remove unsafe sources from our Content Security Policy, which will in turn protect against some injection attacks.
Plus it’s way cleaner.
This includes all text within <script> tags, any event attributes like onclick in a tag, and the style attribute of tags. Elements should instead be identified by class or other attribute and have event handles and styles attached based on those identifiers from separate files (which can be independently checked for integrity)