I recently added Google AdSense to my website and the ads works fine, expect sometimes they don't load and I get the following errors in the console
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src https://cdn.ampproject.org/". Either the 'unsafe-inline' keyword, a hash ('sha256-xxx'), or a nonce ('nonce-...') is required to enable inline execution.
From what I've read I need to added the CSP in my HTML headers, but doesn't seem to fix the problem.
Any tips?
TRY1
This discussion could help to get access to the site with the following snippet:
script-src 'self' http://xxxx 'unsafe-inline' 'unsafe-eval';
TRY2
This documentation will show you how to define the policy with:
Content-Security-Policy: script-src 'self' https://apis.google.com
Hope that will help and you question is answered. Give it a shot, cheers! :)
Related
#console browser issue for Content security Policy
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-9X08/o2ns8hEbTzT0V1Xyn6yYc8qftFOKmH3KNb8dWo='), or a nonce ('nonce-...') is required to enable inline execution.[enter image description here][1]
#Image of the error
[1]: https://i.stack.imgur.com/7R9sp.png
Code written for CSP
frame-ancestors 'self' https:
script-src 'self';
object-src 'none';
base-uri 'none';
style-src 'self' fonts.googleapis.com 'unsafe-inline';
media-src *;
img-src 'self';
It seems the error indicated there's issue with using inline-script.
which looks like
<script>
your codes
</script>
If you're going to use inline script, add 'unsafe-line' to script-src directive.
Current setting only allows scripts that's source of your domain.
ex)
<script src="/yourDomain/public/yourScript.js">
Your script-src directive of 'self' only allows scripts to be loaded as script files from the same domain. Your page also has inline scripts that need to have permission in the CSP to run. You have a few choices:
Move the script code to a separate .js file hosted on the same domain. If you use a different host you'll need to allow that host in your script-src directive.
Add 'unsafe-inline'. This will allow ALL inline scripts, which will pretty much remove the XSS protection that CSP is able to give.
Add the suggested hash value 'sha256-9X08/o2ns8hEbTzT0V1Xyn6yYc8qftFOKmH3KNb8dWo=' to script-src allowing this one script. This is a good solution if there are only one or a few inline scripts to allow.
Add a nonce. Nonces should change on every pageload and are a good solution for dynamic scripts if you are able to inject nonces correctly.
I have a fairly standard Node Express user authentication configuaration. Express-session, cookie-parser are used for sessions / cookies and passport to handle authentication.
I recently added a content security policy to all routes, and it's messing with user sessions. Navigating the site internally is fine. If you manually type a url into the browser, also good - it will remember your logged in session.
However, if you access the site via a bookmark, or follow a link from a 3rd party website, the user is thrown out and forced to log in again. If I disable the content security policy, everything is fixed.
Can anyone advise on why this happens, or what to investigate, as I'm a bit in the dark as to how it could be happening.
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-b2bd8bb3d70af06062931f9217eeec75'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
default-src 'self' set all these below to 'self':
child-src
connect-src
font-src
frame-src
img-src
manifest-src
media-src
object-src
prefetch-src
script-src
script-src-elem
script-src-attr
style-src
style-src-elem
style-src-attr
worker-src
I would add them all manually one by one and see which one of these introduce the issue you are having. After this you can remove them all again and add the whitelisting you need.
A good practice aswell is too add a report-uri to fetch all the times you get blocked. Maybe in the report there is aswell some more usefull information. You can aswell enable a 'report-only' mode until you are confident the issue you are having is resolved. Another resource I can suggest is the CSP evaluator from Google; it suggestions are really useful.
Hope this answer helps you find why your users get logged out!
OK, this was a bad question...
The cause was that in the same commit, that the content-security-policy was originally added, I also set the cookie sameSite property to true. It was a mistake of me to not separate my commits better. Problem solved...
I am trying to use a hash with my content security policy...
Below are two example errors in my console:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' apis.google.com cdn.iubenda.com cdnjs.cloudflare.com www.googletagmanager.com". Either the 'unsafe-inline' keyword, a hash ('sha256-oKmCrr+GWRARSXYeVJshOWETr0oqOtt73CNO8efpujQ='), or a nonce ('nonce-...') is required to enable inline execution.
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' apis.google.com cdn.iubenda.com cdnjs.cloudflare.com www.googletagmanager.com". Either the 'unsafe-inline' keyword, a hash ('sha256-pS4Uy3ilo+JLn8IadtJGfyO9z7jqIrGUONfEUDLxoPk='), or a nonce ('nonce-...') is required to enable inline execution.
Here is the corresponding content security policy directive:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' apis.google.com cdn.iubenda.com cdnjs.cloudflare.com www.googletagmanager.com; style-src 'self' fonts.googleapis.com; img-src 'self' cdn.shortpixel.ai secure.gravatar.com; font-src 'self' fonts.googleapis.com fonts.gstatic.com";
Specifically in this example:
script-src 'self' apis.google.com cdn.iubenda.com cdnjs.cloudflare.com www.googletagmanager.com;
From what I gathered from reading the CSP guide on hashes, I should be able to add the hash as per my console to the directive...
The easiest way to generate it is to just open the developer tools console and it will output what the expected hash of your script was in the console error message.
But if I modify my directive to include the hash (example below), I still get the same error in console (obviously with a different hash).
script-src 'self' apis.google.com cdn.iubenda.com cdnjs.cloudflare.com www.googletagmanager.com 'sha256-oKmCrr+GWRARSXYeVJshOWETr0oqOtt73CNO8efpujQ=';
How exactly is the correct way to hash a CSP directive? And why are there multiple errors for the same directive, is this basically one for each domain specified? Should one hash cover all the domains specified?
Not really sure how I should be doing this.
From what I gathered from reading the
content-security-policy.com/hash/ CSP guide on hashes, I should be
able to add the hash as per my console to the directive...
Yeah, it's working only "theoretically", the "practice" is more hard. Yes, Google Chrome calcs hashes, but you need to read the error message carefully to determine what is really blocked: inline script, javascript: navigation or inline event handler. Because each of these have own way how to fix.
- Inline scripts can be just allowed by 'sha256-VALUE' token.
- to allow javascript: navigation and inline event handlers you need to use 'sha256-VALUE' tokens with 'unsafe-hashes'. And not all browsers support 'unsafe-hashes' for javascript: navigation as for now.
But if I modify my directive to include the hash (example below), I
still get the same error in console (obviously with a different hash).
Why do you stopped? I see you use www.googletagmanager.com (GTM), do you think GTM has only one inline script? You allowed the parent script, it began to load the child ones, so you need hashes for both.
You can use parent script hash + 'strict-dynamic' token to allow all the childs ones, but it does not work in Safari as for now.
At the final you will get a lot of hashes for all inline scripts. Bad thing is that GTM and others can time to time change content of it inline scripts, so you have to add a new hashes and to remove obsoletes. But you don't know which hash to which script belongs.
Therefore the preferable way is to use 'nonce-value' for any inline scripts, all the more since GTM distributes 'nonce' to all inline scripts except Custom HTML Tags. For Custom HTML Tags(if used) you can use hashes, because those scripts is under your control.
It's better to investigate all inline scripts manually before decide how it easier and reliable way to allow them.
PS: GTM is a hard nuts for CSP because GTM can be used to inject a open list of inline/external scripts. And if use the custom JavaScript variable names are used for the «Custom HTML tag», it required to allow 'unsafe-eval'.
You can test your GTM ID for what additional scripts it loads and which CSP is enough for it.
I've been having ongoing hurdles with my CSP policy and trying to whitelist the urls for my cookie banner (Iubenda). Between Chrome's developer tools and ReportURI, I can get everything to work and nothing gets blocked.
Until Iubenda updates it's vendor list (which happens randomly and often). They change the version # in the url so it no longer passes through my CSP. The most recent example: https://cdn.iubenda.com/cs/tcf/v2/vendorlist.46.json is whitelisted under "connect-src" and works. Except they just updated the vendorlist and the url is now https://cdn.iubenda.com/cs/tcf/v2/vendorlist.47.json
I tried using a wildcard to try an include future variations of the file, or even to include all links that come from the site httsp://cdn.iubenda.com/* as well as including 'self' - but I have a feeling it's not the right solution. Is there a better way to write the exception so I don't have to keep checking every few weeks if they updated the link (which can prevent my cookie banner from displaying).
My coding skills are poor, so it could be something simple that I've missed.
Have you tried following here? https://www.iubenda.com/en/help/12260-how-to-configure-content-security-policy-to-allow-iubenda-scripts-to-execute
They suggest something similar:
Content-Security-Policy:
default-src 'self';
script-src 'self' *.iubenda.com 'nonce-EDNnf03nceIOfn39fn3e9h3sdfa' 'unsafe-eval';
connect-src *.iubenda.com;
style-src 'unsafe-inline' *.iubenda.com;
frame-src *.iubenda.com;
img-src *.iubenda.com data:
My application requires external URL of GoogleMap API to be executed in a packaged App. When I execute the code on simulator, I get the following error in Security Tab
"Content Security Policy: The page's settings blocked the loading of a resource at https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=true&callback=initialize ("script-src app://58b444ed-2bd9-4ce2-8687-09694b09d6ae")."
Kindly provide a solution to handle this
Regards
Rashmi
There are few reasons why you might get a CPS error. Please refer to this url for more information. https://developer.mozilla.org/en-US/Apps/Build/Building_apps_for_Firefox_OS/CSP
By default, CSP is enforced only on privileged and certified apps. If you have a simple packaged app, you shouldn't have CSP issues. If you didn't mention anything for the app type, you shouldn't have issues.
The CSP for privileges app are:
"default-src *;
script-src 'self';
object-src 'none';
style-src 'self' 'unsafe-inline'"
And for certified:
"default-src *;
script-src 'self';
object-src 'none';
style-src 'self'"
Which mean that you cannot have a script that points on a remote server other than your own. If your packaged app is loading an external url, you could probably proxy the google js trough your server. As the script-src will match the default-src, it should work.
Otherwise, you could probably save the script directly in your project. This is probably not recommended but that could also work.
There is also chances that the script provided by google won't work anyway if they use eval and new Function.