CODEWITHSUNDEEP
node.jsmeteorreact-helmethelmet.js
VikR
VikR

Reputation: 5142

Helmet Rejects Localhost Even Though it is Included in Script-Src?

I'm running my node.js web app at:

http://localhost:3000/

I'm getting this error from Helmet:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'unsafe-inline' 'sha256-DFWWwGm2cBwXA13nbn4jDkHCl2Oc/0Z2tKvKkN4NWj4=' http://localhost:3000/ http://localhost:4000/ [.....]". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.

http://localhost:3000/ is listed in the script-src directive. Why am I getting this error?

Upvotes: 0

Views: 184

Answers (1)

Evan Hahn
Evan Hahn

Reputation: 12737

From the error message, it looks like you're trying to execute an inline script, which isn't allowed by your CSP.

You've included "unsafe-inline" which would normally allow it, but the SHA causes that to be ignored; see the last sentence in the error message.

Upvotes: 1

Related Questions