I'm getting a CSP error when adding a random value in script-src. This is the CSP - Content Security Policy I'm setting up: default src 'none'; script -src 'self' 'unsafe evaluation' nonce -b1967a39a02f45edbac95cbb4651bd12 'unsafe hash'; frame -src 'self' nonce - b1967a39a02f45edbac95cbb4651bd12 'unsafe hash'; connect -src 'self'

The error message indicates that you have an inline event handler, which means you have an onclick, onblur, onchange, etc. attribute somewhere. The error message may contain links to the actual code. To allow inline event handlers you need to use one of these "unsafe-hashes" and hashes of code 'Unsafe inlining' However, if you are able to rewrite the code, your best option is to use an event listener. The property is not nonceable, so your nonce method does not work with this code.

How to fix CSP errors? "Execution of the inline event handler is denied because it violates the following Content Security Policy directive..."

<p>我在 script-src 中添加随机数值时收到 CSP 错误。这是我正在设置的 CSP - 内容安全策略：默认 src '无'； script-src 'self' '不安全评估' 'nonce-b1967a39a02f45edbac95cbb4651bd12' '不安全哈希'; frame-src 'self' 'nonce-b1967a39a02f45edbac95cbb4651bd12' '不安全哈希';连接-src'自我'； img-src“自身”数据：； style-src 'self' '不安全内联';对象-src'自我'； font-src'自身'数据：;</code></p> <p>我的JS文件内容是-</p> <pre class="brush:php;toolbar:false;"><html dir="ltr"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title> WebHelp Navigation Toolbar </title> <style>  </style> <script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whver.js" charset="utf-8"></script> <script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whutils.js" charset="utf-8"></script> <script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whmsg.js" charset="utf-8"></script> <script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whproxy.js" charset="utf-8"></script> <script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whmozemu.js" charset="utf-8"></script> <script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whtbar.js" charset="utf-8"></script> <script nonce='b1967a39a02f45edbac95cbb4651bd12' type="text/javascript" language="JavaScript1.2"> //<![CDATA[ function printTopic() { var topicPane; if (top.frames[0].name == "ContentFrame") topicPane = top.frames[0].frames[1].frames[1]; else topicPane = top.frames[1].frames[1]; topicPane.focus(); var msg = new whMessage(WH_MSG_PRINT, 0, 0); notify(msg); } //]]> </script> </head> <body marginheight="0" marginwidth="0" bgcolor="#363f48" background="background.png" scroll="no"> <script nonce='b1967a39a02f45edbac95cbb4651bd12' language="javascript1.2">  </script> </body></pre> <p>从 script-src 中删除“unsafe-inline”并添加“nonce-b1967a39a02f45edbac95cbb4651bd12”后，我收到此错误。在这个问题上纠结了好久。需要一些指导。提前致谢。</p>

P粉781235689453 days ago834

How to fix CSP errors? "Execution of the inline event handler is denied because it violates the following Content Security Policy directive..."

reply all(1)I'll reply