From 44f98d5286acf9a30b7e8ead66bc3239044e4994 Mon Sep 17 00:00:00 2001
From: Sam <sam@geyskens.eu>
Date: Sun, 1 Mar 2026 00:31:30 +0100
Subject: [PATCH] unsafe-inline fix

---
 backend/app.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/app.py b/backend/app.py
index e64d47e..caa6dbf 100644
--- a/backend/app.py
+++ b/backend/app.py
@@ -91,7 +91,7 @@ def create_app():
     # unsafe-inline is uitgeschakeld voor scripts — gebruik {{ csp_nonce() }} in <script> tags
     csp = {
         'default-src':  ["'self'"],
-        'script-src':   ["'self'", 'cdnjs.cloudflare.com'],   # nonce wordt auto toegevoegd
+        'script-src':   ["'self'", 'cdnjs.cloudflare.com', "'unsafe-inline'"],  # unsafe-inline wordt genegeerd door browsers die nonce ondersteunen
         'style-src':    ["'self'", "'unsafe-inline'"],         # inline styles in templates (aanvaardbaar)
         'img-src':      ["'self'", 'data:'],
         'font-src':     ["'self'"],