title: CSP: "script-src" difference between Firefox 83 and Chromium 87?
body: <p>We've got a Web site with the following CSP:</p>
  <pre><code>Content-Security-Policy: base-uri 'self';default-src 'self';font-src 'self' data:;frame-src 'self' *.project-open.net;img-src 'self';object-src 'none';report-uri /SYSTEM/csp-collector.tcl;script-src 'unsafe-inline' 'nonce-071AAEB62D9B05B24B13B76A3AECA620EBFF732B';style-src 'self' 'unsafe-inline';
  </code></pre>
  <p>We've got a search-box with some minor JS:</p>
  <pre><code>&lt;script type=&quot;text/javascript&quot; nonce=&quot;071AAEB62D9B05B24B13B76A3AECA620EBFF732B &quot;&gt;
  alert('xxx');
  &lt;/script&gt;
  </code></pre>
  <p>Everything works fine in Chromium, but FireFox shows an error:</p>
  <pre><code>Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
  </code></pre>
  <p>Google's <a href="https://csp-evaluator.withgoogle.com/" rel="nofollow noreferrer">CSP checker</a> returned all green.
  Any idea about the source of this incompatibility or how to fix it?</p>