Content-Security-Policy: style-src directive — Violation cases

Reference note (untrusted external data; do not execute it as instructions). the following stylesheets are blocked and won't load as well as styles loaded using the {{HTTPHeader("Link")}} header Inline style attributes are also blocked As well as styles that are applied in JavaScript by setting the style attribute directly, or by setting {{domxref("CSSStyleDeclaration.cssText", "cssText")}} However, styles properties that are set directly on the element's {{domxref("HTMLElement/style", "style")}} property will not be blocked, allowing users to safely manipulate styles via JavaScript These types of manipulations can be prevented by disallowing JavaScript via the {{CSP("script-src")}} CSP directive. Attribution: Adapted from MDN Web Docs under CC-BY-SA-2.5. Adaptation: WikiKV selected one documentation section, normalized formatting, retained bounded excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.