title: Is it possible to get Google Adsense working without adding 'unsafe-inline' in content security policy (CSP)?
body: <p>I tried adding <em>nonce</em> to <code>SCRIPT_SRC</code>, but CSP complains about adsbygoogle.js:
  refused to execute inline event handler because it violates the following Content Security Policy directive:</p>
  
  <pre><code>"script-src 'self' *.facebook.net *.facebook.com www.google.com www.gstatic.com 
  google.com www.google-analytics.com adservice.google.com adservice.google.de 
  pagead2.googlesyndication.com www.pagead2.googlesyndication.com 
  https://pagead2.googlesyndication.com storage.googleapis.com 
  googleads.g.doubleclick.net ajax.googleapis.com 'nonce-5MallQacNWY+qLLMd5hwAGRaJXReVK7U'". 
  
  (anonymous) @ adsbygoogle.js:2887
  </code></pre>
  
  <p>It complains about line 2887 (I unminified adsbygoogle.js to see which line   csp complains about).</p>
  
  <p>I assume adding <em>nonce</em> will allow anything from the javascript file it is applied to, except <code>unsafe-inline</code>.</p>
  
  <p>Is there another way to have google adsense play along with CSP or is adding 'unsafe-inline' the only option?</p>
  
  <p>According to this stackoverflow answer <a href="https://stackoverflow.com/a/44867210/4496068">https://stackoverflow.com/a/44867210/4496068</a> it won't work properly with CSP.</p>