拒绝应用内联样式，因为它违反了以下“内容安全策略"指令:现代性 [英] Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'" modernizr

问题描述

我在Visual Studio 2015 Professional中创建了一个新的asp.net mvc 5项目并且我在内容安全政策的布局中添加了元标记--

I have created new asp.net mvc 5 project in visual studio 2015 professional And I have added meta tag in my layout for Content Security Policy as -

<meta http-equiv="content-security-policy"
  content="default-src 'none'; script-src 'self';
  connect-src 'self'; img-src 'self'; style-src 'self';" />

现在，当我运行我的应用程序时，我在chrome浏览器控制台中收到以下错误-

Now when I run my application I get following error in chrome browser console -

拒绝应用内联样式，因为它违反了以下内容安全策略"指令:"style-src'self'".要启用内联执行，需要使用"unsafe-inline"关键字，哈希("sha256-CwE3Bg0VYQOIdNAkbB/Btdkhul49qZuwgNCMPgNY5zw =")或随机数("nonce -...").modernizr-2.6.2.js:157

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-CwE3Bg0VYQOIdNAkbB/Btdkhul49qZuwgNCMPgNY5zw='), or a nonce ('nonce-...') is required to enable inline execution. modernizr-2.6.2.js:157

modernizr-2.6.2.js:157有6个错误，其中一个与脚本有关，即拒绝加载脚本localhost

There are 6 errors for modernizr-2.6.2.js:157 and one is related to script, i.e. refused to load the script localhost

我认为我的项目中没有任何内联样式，为什么CSP拒绝应用错误?

I don’t think I have any inline style in my project and then why CSP refused to apply error ?

推荐答案

显然，modernizr要么注入具有某些CSS属性的 style 元素，要么注入一些 style 属性；您可以通过以下方式更改CSP策略来处理它:

Apparently modernizr either injects a style element with some CSS properties, or else injects some style attributes; you can deal with it by changing your CSP policy this:

<meta http-equiv="content-security-policy"
  content="default-src 'none'; script-src 'self';
  connect-src 'self'; img-src 'self';
  style-src 'self' 'sha256-CwE3Bg0VYQOIdNAkbB/Btdkhul49qZuwgNCMPgNY5zw=';" />

这篇关于拒绝应用内联样式，因为它违反了以下“内容安全策略"指令:现代性的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！