Refused to load script from <URL> despite strict-dynamic
- Dominant language
- TypeScript
- Stars
- 49
- Forks
- 11
- PR merge metrics
- No merged PRs in 30d
Description
Hi Team,
I'm using the webpack plugin on Angular app. However, Chrome browser refuses to load the scripts added by the loader. Shouldn't browser trust these scripts because `strict-dynamic` is present and was loaded by the loader script whose `sha256` is allowed in `script-src` ?
```
Refused to load the script 'https://myapp.mywebsite.com/app/4493-ce4021c07yds7s87.js'
because it violates the following Content Security Policy directive:
"script-src 'strict-dynamic' 'sha256-mdiRA9U1beoJQUxqe51WTscrp2eub7BXW/j51AWQiy8=' https: 'unsafe-inline'".
Note that 'strict-dynamic' is present, so host-based allowlisting is disabled.
Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
```
Contributor guide
Assessment
This issue has not been assessed yet.