CODEWITHSUNDEEP
content-security-policymanifest.jsonhelmet.js
mohammed shahul
mohammed shahul

Reputation: 144

How to use 3rd party libraries and inline scripts in nodejs app while helmet enabled

I was developing a nodejs app and implimented some security , I used helmet like this

app.use(helmet())

now browser does not allow me to use third party libraries and inline script . you can check image

So I found solution. see below

app.use(helmet({  contentSecurityPolicy: false}))

now everything solved . I want to know that why this happen how to use 3rd party libraries and inline scripts without the setting contentSecurityPolicy: false in helmet

I also found about we must include a manifest.json file in public folder and mention all third party libraries in it . how to impliment that ? thanks in advance enter image description here

Upvotes: 1

Views: 828

Answers (1)

Evan Hahn
Evan Hahn

Reputation: 12722

Helmet maintainer here.

This is happening because of something called Content Security Policy, which Helmet sets by default. To solve your problem, you will need to configure Helmet's CSP.

MDN has a good documentation about CSP which I would recommend reading for background. After that, take a look at Helmet's README to see how to configure its CSP component.

In summary: to solve your problem, you will need to tell Helmet to configure your CSP.

Upvotes: 1

Related Questions