search

halirutan / SE-Editor-Buttons

7 stars 7 forks source link

Content Security Policy Blocks Chrome extension #15

Open rodolfohermans opened 3 weeks ago

rodolfohermans commented 3 weeks ago

I'm getting the following error in Chrome. The Content Security Policy (CSP) is effectively blocking the Extension.

The Content Security Policy (CSP) prevents cross-site scripting attacks by blocking inline execution of scripts and style sheets.

To solve this, move all inline scripts (e.g. onclick=[JS code]) and styles into external files.

⚠️ Allowing inline execution comes at the risk of script injection via injection of HTML script elements. If you absolutely must, you can allow inline script and styles by:

adding unsafe-inline as a source to the CSP header adding the hash or nonce of the inline script to your CSP header.

image