Inline scripts seem harmless. You’ve seen them:
<button onclick="checkout()">Pay Now</button>
But this convenience can come at a high cost.
The Security Problem
- Inline scripts can’t be hashed for Subresource Integrity (SRI)
- They can be injected via DOM manipulation
- CSP can’t restrict them without
unsafe-inline
That’s why modern security policies discourage or block inline code.
External Scripts: Safer, But Not Immune
External scripts:
<script src="https://cdn.example.com/main.js"></script>
✅ Can be hashed
✅ Can be gated via CSP
✅ Can be audited over time
But beware:
CDNs may auto-update files, and if compromised, one bad push can affect hundreds of sites.
Breachfin Best Practices
- Avoid
unsafe-inlinein your CSP - Use strict
script-srcdeclarations - Prefer external scripts with SRI
- Monitor script additions with Breachfin
Inline is quick.
External is safer — but only when monitored.
