CODEWITHSUNDEEP
javascripthtmlcontent-security-policy
Jamie Hutber
Jamie Hutber

Reputation: 28076

How to use Content-Security-Policy with localhost files

I am getting the following error on my page:

Refused to load the script 'http://127.0.0.1:35729/livereload.js' because it violates the following Content Security Policy directive: "script-src https: 'unsafe-inline' 'unsafe-eval'".

HTML

<meta http-equiv="Content-Security-Policy" content="default-src * 'unsafe-inline'; style-src * 'unsafe-inline'; script-src * 'unsafe-inline' 'unsafe-eval'; img-src * data: 'unsafe-inline'; connect-src * 'unsafe-inline'; frame-src *;">
 </head>
 <body>
    <script src="http://127.0.0.1:35729/livereload.js"></script>

I have tried to use a completely open just to get it working and then work backwards, however I even get the same error with this.

To be clear, this isn't for producition code, this is just to enable my live-reload-webpack on a domain that is using https.

Upvotes: 8

Views: 22404

Answers (1)

Zelda
Zelda

Reputation: 2124

You can use localhost:, though I believe using 'self' (including the single quotes) would also suffice in this situation. There are some odd cases where * is not actually all-inclusive (blob: for example is also excluded from * I believe).

As always it's good to check out your CSP with Google's Evaluator first.

Upvotes: 10

Related Questions