The 'unsafe-inline' and 'unsafe-eval' are getting appended to the script-src of the CSP header even though the Unsafe-inline and Unsafe-eval are disabled for the frontend pages via WebSecurity advanced setting (Administration -> Settings -> Advanced -> WebSecurity -> HttpSecurityHeaders -> Response Headers -> Content-Security-Policy and uncheck the checkbox Append unsafe-inline and unsafe-eval).

• The page Inline Edition option is disabled by setting the "Enable in-line editing" to False at Administration -> Settings -> Advanced -> Pages.
• The page is based on Web Forms or hybrid page templates.
• The issue is not reproducing on the pages that are based on the MVC Page template.

The issue is due to the page template is using the Hybrid mode. The hybrid page template uses the Web Forms framework (as well as the MVC). For the Web Forms framework to function, it needs to have some values evaluated at runtime in JavaScript and some JavaScript code inserted in attributes or as script tags in the markup. This requires that CSP is configured with "unsafe-inline" and "unsafe-eval" directives for script and CSS resources. So, the 'unsafe-inline' and 'unsafe-eval' are getting appended to the script-src of the CSP header by the Hybrid page mechanism.

The issue can also be reproduced if the page was created as a Hybrid page and then, at some point, migrated to MVC; however, there is a Web Forms widget, and a layout element is still left in this page.

Hybrid page templates are deprecated (see documentation 1 from the Notes section below); use the MVC Page template for the pages.

Make sure all the Web Forms widget and Web Forms layout elements from the page template and page are removed.

References to Other Documentation:

1. Sitefinity Documentation, Deprecated capabilities in Sitefinity CMS https://www.progress.com/documentation/sitefinity-cms/deprecated-capabilities-in-sitefinity-cms