#XSS

A strict Content Security Policy without unsafe-inline

How to ship a CSP with script-src 'self' only, what breaks when you remove inline scripts and eval, and how to fix it without weakening the policy.