7

I have created new asp.net mvc 5 project in visual studio 2015 professional And I have added meta tag in my layout for Content Security Policy as -

<meta http-equiv="content-security-policy"
  content="default-src 'none'; script-src 'self';
  connect-src 'self'; img-src 'self'; style-src 'self';" />

Now when I run my application I get following error in chrome browser console -

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-CwE3Bg0VYQOIdNAkbB/Btdkhul49qZuwgNCMPgNY5zw='), or a nonce ('nonce-...') is required to enable inline execution. modernizr-2.6.2.js:157

There are 6 errors for modernizr-2.6.2.js:157 and one is related to script, i.e. refused to load the script localhost

I don’t think I have any inline style in my project and then why CSP refused to apply error ?

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
vishwajeetrkale
  • 461
  • 2
  • 7
  • 16
  • https://stackoverflow.com/questions/17766817/refused-to-apply-inline-style-because-it-violates-the-following-content-security – Alexred Oct 22 '22 at 03:58

1 Answers1

5

Apparently modernizr either injects a style element with some CSS properties, or else injects some style attributes; you can deal with it by changing your CSP policy this:

<meta http-equiv="content-security-policy"
  content="default-src 'none'; script-src 'self';
  connect-src 'self'; img-src 'self';
  style-src 'self' 'sha256-CwE3Bg0VYQOIdNAkbB/Btdkhul49qZuwgNCMPgNY5zw=';" />
sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
  • thanks @sideshowbarker , that's what i am trying to do and yes it solves my issue, but the problem is i have to do this for all of the errors for my application and this is too much almost 50 errors and i have to copy each hash and add it to respective directive values, any shortcut will be very helpful. – vishwajeetrkale Jun 12 '17 at 12:08
  • 3
    If modernizr is injecting all that inline stuff than it seems like your choices are to either (a) add all those hashes, (b) use 'unsafe-inline' (but which basically defeats the whole purpose of CSP…), or (c) don’t use modernizr – sideshowbarker Jun 12 '17 at 12:10