The script was refused a download because it violates the following content security policy directive: "style-src" self '' unsafe-inline '

Question

I am using MVC6 (asp.net 5) using angular and trying to load scripts from cdn places when my code is in release mode but for some reason the scripts NEVER load.

I read that you need to add a meta tag to your html file, which I did, for example.

<meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' https://ajax.aspnetcdn.com; font-src 'self' http://netdna.bootstrapcdn.com" /> 

And on my Index.cshtml I have this.

 <environment names="Staging,Production"> <script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.8/angular.min.js" asp-fallback-src="~/lib/angular/angular.min.js" asp-fallback-test="window.angular"> </script> <script src="https://cdnjs.cloudflare.com/ajax/libs/angular-ui-router/0.2.15/angular-ui-router.min.js" asp-fallback-src="~/lib/angular-ui-router/release/angular-ui-router.js" asp-fallback-test="window.angular && window.angularUiRouter"> </script> <script src="https://cdnjs.cloudflare.com/ajax/libs/angular-local-storage/0.2.2/angular-local-storage.min.js" asp-fallback-src="~/lib/angular-local-storage/dist/angular-local-storage.js" asp-fallback-test="window.angular && window.localStorage"> </script> 

But they never load. I tried to run the code using IISExpress, as well as using the DNX Web command.

I have this post, which is how I get started creating the META tag, but don't know why it doesn't work. I tried this in Chrome and under the console, I just get such errors

Answer 1

Put the following in the header section of the web page:

 <meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://cdnjs.cloudflare.com "> 

You can read more about the content security policy here and here .

Answer 2

In my case, this policy is set through SecurityHeadersAttribute (this attribute is set in AccountController and some others).

It basically adds a default policy to headers that overwrites the meta tag. Therefore, you need to change this policy or remove the attribute from the controller.