title: My scripts are inlined by some mobile carriers - How to deal with that?
body: <p>Some pages aren't correctly received on mobile phones (many ones in France) : JavaScript script elements are inlined.</p>
  
  <p>Instead of having </p>
  
  <pre><code> &lt;script src="static/jquery-2.1.3.min.js"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>I have</p>
  
  <pre><code> &lt;script&gt; ... content of the whole jQuery script ... &lt;/script&gt;
  </code></pre>
  
  <p>As the Content Security Policy header I set forbids inline scripts, modern browsers block the execution of the script. </p>
  
  <p>Is there a way to deal with that other than using HTTPS ? Maybe some way to specify the page shouldn't be rewritten by third parties ?</p>
  
  <p>Notes :</p>
  
  <ul>
  <li>the CSP header isn't enough a hint for the third-party doing the transformation</li>
  <li>the <code>Cache-Control:no-transform</code> header is ignored as well</li>
  <li>any answer involving the addition of an inline script isn't an answer as the goal is to remove all inline scripts for security</li>
  <li>the problem <strong>isn't related</strong> to the injection of supplementary scripts (that wouldn't break my site as the browser is instructed not to execute them) but to the <em>inlining</em> of the existing scripts</li>
  <li>the problem isn't specific to any operator : I'm looking for a (reasonnably) general solution</li>
  </ul>