google / google/strict-csp

Refused to load script from <URL> despite strict-dynamic

Open
#50 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
49
Forks
11
PR merge metrics
No merged PRs in 30d

Description

Hi Team,

I'm using the webpack plugin on Angular app. However, Chrome browser refuses to load the scripts added by the loader. Shouldn't browser trust these scripts because `strict-dynamic` is present and was loaded by the loader script whose `sha256` is allowed in `script-src` ?

```
Refused to load the script 'https://myapp.mywebsite.com/app/4493-ce4021c07yds7s87.js'
because it violates the following Content Security Policy directive:
"script-src 'strict-dynamic' 'sha256-mdiRA9U1beoJQUxqe51WTscrp2eub7BXW/j51AWQiy8=' https: 'unsafe-inline'".
Note that 'strict-dynamic' is present, so host-based allowlisting is disabled.
Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.