Content Security Policy Contains `unsafe-*` Directive

Problem description

The vulnerability scan reports "Content Security Policy Contains unsafe-* Directive" on the Nextcloud SAML login selection page:

/index.php/apps/user_saml/saml/selectUserBackEnd

After reviewing the response headers, the issue appears to be caused by the CSP generated by the application itself, most likely Nextcloud or the user_saml app, and not by the Apache web server configuration.

The relevant part of the delivered Content Security Policy contains:

• script-src 'nonce-...' 'strict-dynamic'
• script-src-elem 'strict-dynamic' 'nonce-...'
• style-src 'self' 'unsafe-inline'

The scan is triggered because unsafe-inline is present in the style-src directive.

Why this is an issue

The use of unsafe-inline weakens the protection normally provided by a Content Security Policy.
In this specific case, the problem affects inline styles, because the application currently allows:

style-src 'self' 'unsafe-inline'

Start with the response headers for /index.php/apps/user_saml/saml/selectUserBackEnd and trace where the user_saml or Nextcloud application generates its Content Security Policy. Check which inline styles require the current style-src 'unsafe-inline' allowance. Done means the endpoint no longer delivers unsafe-inline while the SAML login selection page continues to work.