2
votes

My Error in console is the below:

Refused to load the stylesheet 'data:text/css,@import%20url%28%27http%3A//localhost%3A8080/scorm/company1/scorm12/style/assessment.css%27%29%3B' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.googleapis.com".

My Content-Security-Policy in http-header is the below:

'Content-Security-Policy' "default-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com http://www.google-analytics.com 'unsafe-inline';  **style-src * 'unsafe-inline'** ; 

The problem is I used style-src, but why the error is occurring I don't know. Please help me and explain the detail of the error.

The most important thing is I am now using this policy in my business project.

So I want to be hurry.

1

1 Answers

1
votes

Why do you do double "wild-cards" (**) in **style-src * 'unsafe-inline'**?

It should be "default-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com http://www.google-analytics.com 'unsafe-inline'; style-src * 'unsafe-inline'"