内容安全策略:页面的设置阻止了资源的加载 [英] Content Security Policy: The page's settings blocked the loading of a resource

问题描述

我在页面加载时使用了验证码，但由于某种安全原因而被阻止

I am using captcha on page load but it is blocking because of some security reason

我正面临问题:

    Content Security Policy: The page's settings blocked the loading 
    of a resource at 
    http://www.google.com/recaptcha/api.js?onload=myCallBack&render=explicit 
    ("script-src http://test.com:8080 'unsafe-inline' 'unsafe-eval'").

我使用了以下js和meta标记:

I have used the following js and meta tag:

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'">
<script src="http://www.google.com/recaptcha/api.js?onload=myCallBack&render=explicit" async defer></script>

推荐答案

您已经说过，您只能从自己的站点(自身)加载脚本.然后，您尝试从另一个网站(www.google.com)加载脚本，并且由于限制了此操作，因此您不能这样做.这就是内容安全策略(CSP)的重点.

You have said you can only load scripts from your own site (self). You have then tried to load a script from another site (www.google.com) and, because you've restricted this, you can't. That's the whole point of Content Security Policy (CSP).

您可以将第一行更改为:

You can change your first line to:

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://www.google.com">

或者，也许值得完全删除该行，直到您了解有关CSP的更多信息.无论如何，您当前的CSP非常宽松(允许unsafe-inline，unsafe-eval和default-src为*)，因此说实话可能并没有增加太多的价值.

Or, alternatively, it may be worth removing that line completely until you find out more about CSP. Your current CSP is pretty lax anyway (allowing unsafe-inline, unsafe-eval and a default-src of *) so probably is not adding too much value to be honest.

这篇关于内容安全策略:页面的设置阻止了资源的加载的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！