Describe the bugTurbolinks execution is being blocked by CSP. Fortunately, thanks to graceful Turbolinks degradation, this does not break the functionality of the site, but it does offer a degraded experience.
Expected behavior
Turbolinks will succesfully manipulate the DOM without complaining in the Developer Console.
Actual behavior
Turbolinks will not work at all and the Developer Console will contain errors like:
(in Chromium): Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https: blob: 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-kNsc6jGDQTbFAcGltvS/pj7jJV5lsm2kMt2bm8elDP0='), or a nonce ('nonce-...') is required to enable inline execution.
(in Chromium): turbolinks.js:559 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' https: 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-HjRaSleBeGtYg1lEvII0j27Iw0w3TWo4+qNLlFD0zJ0='), or a nonce ('nonce-...') is required to enable inline execution.
(in Firefox): Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").
Desktop:
OS: tested on Ubuntu Linux, but potentially all major OSes are affected
Browser: tested on Chromium and Firefox, but potentially all major browsers are affected
Version: potentially all new versions of major browsers are affected
Additional context
Since this is not a critical bug, it might be clever to solve this problem when/if the project moves on to Turbo, as Turbolinks is deprecated.
Describe the bug Turbolinks execution is being blocked by CSP. Fortunately, thanks to graceful Turbolinks degradation, this does not break the functionality of the site, but it does offer a degraded experience.
To Reproduce Steps to reproduce the behavior:
Expected behavior Turbolinks will succesfully manipulate the DOM without complaining in the Developer Console.
Actual behavior Turbolinks will not work at all and the Developer Console will contain errors like:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https: blob: 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-kNsc6jGDQTbFAcGltvS/pj7jJV5lsm2kMt2bm8elDP0='), or a nonce ('nonce-...') is required to enable inline execution.turbolinks.js:559 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' https: 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-HjRaSleBeGtYg1lEvII0j27Iw0w3TWo4+qNLlFD0zJ0='), or a nonce ('nonce-...') is required to enable inline execution.Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").Desktop:
Additional context Since this is not a critical bug, it might be clever to solve this problem when/if the project moves on to Turbo, as Turbolinks is deprecated.