CODEWITHSUNDEEP
javascriptaxioscontent-security-policyscript-src
Tarun U M
Tarun U M

Reputation: 35

Refused to load the script : Content-Security-Policy

Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/axios/0.18.0/axios.min.js' because it violates the following Content Security Policy directive: "script-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

script(src='https://cdnjs.cloudflare.com/ajax/libs/axios/0.18.0/axios.min.js')

so i tried adding this meta header though it throws the same error

meta(http-equiv='Content-Security-Policy' content="script-src 'self' https://cdnjs.cloudflare.com/ 'unsafe-inline' 'unsafe-eval'")

Upvotes: 2

Views: 10732

Answers (2)

Alpha
Alpha

Reputation: 52

if you are using helmet in node then this worked for me

app.use( helmet({ contentSecurityPolicy: false }) );

Upvotes: 3

Halvor Sakshaug
Halvor Sakshaug

Reputation: 3475

You likely have a default Content Security Policy served as a response header. Adding another policy in meta tag can only make it stricter as all content needs to pass all policies. You need to identify what sets the CSP with "script-src 'self'" and modify that policy.

Upvotes: 1

Related Questions