'Style CSP violation inside script
I have a JS external library script in my web application (physically located on my server).
The script violates CSP. Having CSP header set to
script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' allows it to run.
I'd like to abandon 'unsafe-inline' 'unsafe-eval' and specify explicitly only that script to be allowed to run desipte violating CSP.
I tired using: script-src 'self' 'nonce-12345'; style-src 'self' 'nonce-12345' and the script is imported: <script src="/Content/libs/xxx/xxx.js?v=637775866579115407" nonce="12345"></script>
But the script still gets bloked:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-12345'". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution.
So the script itself run, but fails because of the style violation.
If I add 'sha256-47...' to the style-src header it works.
Why does it gets blocked despite having nonce set?
Is there any way of letting it pass without specifying sha256 hash?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|