CODEWITHSUNDEEP
expresssecuritycontent-security-policy
user3524762
user3524762

Reputation: 642

CSP and inline scripts getting blocked

Struggling with understanding CSP, getting

Refused to apply inline style because it violates the following Content Security Policy directive: "script-src 'self' https://example;"

Example, my domain is https://example.com, in my policy, I have script-src 'self' https://example; yet inline scripts from https://example/static/js/19.b56ecbe.chunk.js is getting blocked.

I would have thought that 'self' would allow the script to run, what am I getting wrong here?

Upvotes: 3

Views: 5065

Answers (1)

Juraj Martinka
Juraj Martinka

Reputation: 4348

@sideshowbarker already explained why you cannot do that but there's a little variant you can use if you want to allow "inline scripts" on your pages.

Just include nonce in all your script tags as well as in the CSP header itself. Look here for more details: https://www.troyhunt.com/locking-down-your-website-scripts-with-csp-hashes-nonces-and-report-uri/

Upvotes: 4

Related Questions