title: antiClickJack snippet's style tag part being inline requires unsafe-inline. How can we avoid the use of unsafe-inline?
body: <p>I am working on Drupal 9.3.8 site and using <a href="https://www.drupal.org/project/csp" rel="nofollow noreferrer">CSP module</a> to setup the CSP header.
  There are few core dependencies or contrib modules which require unsafe-inline in CSP header but scanner recommends not the have unsafe-inline, so looking for the fix to remove the use of unsafe-inline.</p>
  <p>Dependencies that require unsafe-inline:</p>
  <ul>
  <li>Drupal core ckeditor, modernizer and AJAX calls - which can be handled by CSP module used above which adds unsafe-inline only when ckeditor renders, but not when only modernizer is required.</li>
  <li><a href="https://www.drupal.org/project/google_analytics" rel="nofollow noreferrer">Google Analytics</a> module - which adds the script inline instead of putting it in a file and include it on each page. We have the <a href="https://www.drupal.org/project/google_analytics/issues/3170031" rel="nofollow noreferrer">patch compatible with D7</a> but not for D8/9.</li>
  <li>AntiClickJack snippet which is as below:</li>
  </ul>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;style id="antiClickjack"&gt;body{display: none !important;}&lt;/style&gt;</code></pre>
  </div>
  </div>
  </p>
  <p>Solutions:</p>
  <ul>
  <li>Installed and setup CSP module as mentioned above to handle Drupal core libs/dependencies requirement.</li>
  <li>To handle only rendering of modernizer.js and unsafe-inline, will need customization to the CSP module.</li>
  <li>For antiClickJack and google analytics script and style tags, cannot add hash or nonce as unsafe-inline will be ignored which will break the handling of Drupal core requirements</li>
  </ul>
  <p>CSP header that I have is as below:
  Content-Security-Policy: default-src 'self'; connect-src 'self' www.google-analytics.com; frame-src 'none'; img-src 'self' data: https://www.google-analytics.com; object-src 'none'; script-src 'self' <a href="http://www.googletagmanager.com" rel="nofollow noreferrer">www.googletagmanager.com</a> <a href="http://www.google-analytics.com" rel="nofollow noreferrer">www.google-analytics.com</a> ajax.googleapis.com 'unsafe-inline'; script-src-elem 'self' <a href="http://www.googletagmanager.com" rel="nofollow noreferrer">www.googletagmanager.com</a> <a href="http://www.google-analytics.com" rel="nofollow noreferrer">www.google-analytics.com</a> ajax.googleapis.com; style-src 'self' 'unsafe-inline'; frame-ancestors 'none';</p>
  <p>Questions:</p>
  <ol>
  <li>How to handle antiClickJack snippet to avoid the use of unsafe-inline?</li>
  <li>Do we have a customized approach to add the google analytics script to a file instead of adding it inline?</li>
  </ol>