I wanted to experiment with Javascript and created a file that I opened in Firefox (68.0.1) file:///C:/play/my.html. The file is on JSFiddle at https://jsfiddle.net/PatS2265/7r4j6ewa/ (but the code works in JSFiddle).
In Firefox when I opened this file I got the following error in the console:
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
I looked up how to fix this and tried adding:
<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://www.google.com">
but this didn't fix it. The file is shown below (with my failed attempt at adding the Content-Security-Policy meta tag.
What is the correct syntax for the Content-Security-Policy?
NOTE: In Chrome (v76.0.3809.100), this file just worked so that my work around for now.
<!DOCTYPE html>
<html>
<head>
<title>My Async Test</title>
<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://www.google.com">
<meta charset="UTF-8" />
</head>
<body>
<script>
function clickMe() {
f().then(alert);
}
async function f() {
return 1;
}
</script>
Just testing
<button type="button" onclick="clickMe()">Run Async Function</button>
</body>
</html>
Searches
I did a search for how to fix this and came across a solution to disable the Content-Security-Policy.
- Disabling Content Security in Firefox. This worked for me but is pretty heavy handed, so I'd like to know how to do it in my file.
Other results that were helpful were:
I just found tag in StackOverflow for content-security-policy so I'll start that search now.
