Cloudflare injects its JS-detection bootstrap inline into origin HTML.
`script-src 'self'` stops it executing, so the challenge never records
that it was solved and Cloudflare serves another one on the next
request -- a loop no visitor can escape, which reads as a Cloudflare
bug rather than a header of ours.
Allowing it needs `'unsafe-inline'`, since an inline script cannot be
allowlisted by URL and Cloudflare cannot know a nonce we generate. That
is a real weakening, so it is opt-in: the default policy is unchanged
byte for byte, and only an instance Cloudflare actually fronts turns it
on. Nothing else in the policy relaxes.
Co-Authored-By: Claude Opus 5 <[email protected]>
SalastilandClaude Opus 5
eb1b9e0682