CODEWITHSUNDEEP
asp.netgoogle-chromefirefoxcontent-security-policyidentityserver3
FreshDev
FreshDev

Reputation: 328

Refused to load because it violates Content Security Policy

I am facing a very weird issue with Content Security Policy in Chrome and Firefox.

My meta tags looks as follows:

<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' http://* https://* 'unsafe-inline'; script-src 'self' http://* https://* 'unsafe-inline' 'unsafe-eval'" />

These lines are creating problems:

Link tag:

<link href='https://fonts.googleapis.com/css?family=Lato:400,700,900' rel='stylesheet' type='text/css'>

Script tag in body:

<script>
        (function (i, s, o, g, r, a, m) {
            i['GoogleAnalyticsObject'] = r; i[r] = i[r] || function () {
                (i[r].q = i[r].q || []).push(arguments)
            }, i[r].l = 1 * new Date(); a = s.createElement(o),
            m = s.getElementsByTagName(o)[0]; a.async = 1; a.src = g; m.parentNode.insertBefore(a, m)
        })(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');

        ga('create', 'UA-76462125-1', 'auto');
        ga('send', 'pageview');

        var dimensionValue = 'SOME_APP_NAME';
        ga('set', 'dimension1', dimensionValue);

</script>

Video tag below in my page:

<video controls="controls">
    <source src="https://www.youtube.com/embed/OhFel6HTHu8" type="video/mp4" />
</video>

Please tell me what I am missing.

Upvotes: 1

Views: 2516

Answers (1)

Brock Allen
Brock Allen

Reputation: 7435

If you check the HTTP response, IdentityServer issues CSP headers. You can configure them by setting the various flags on the CspOptions. It's covered in the docs: https://identityserver.github.io/Documentation/docsv2/advanced/csp.html

Upvotes: 1

Related Questions