Disabling inline Javascript using CSP (Content-Security-Policy) header

csp.py

from flask import Flask, make_response

app = Flask(__name__)

send_csp = True
csp = 'script-src'

html = """
Hello
<script>alert('xs')</script>
world
<button onclick="alert('xss')" text="click me">
"""

@app.route('/')
def hello_world():
    resp = make_response(html, 200)

    if send_csp:
        resp.headers['Content-Security-Policy'] = csp

    return resp