vishwajeetrkale vishwajeetrkale -4 years ago 321
ASP.NET (C#) Question

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'" modernizr

I have created new asp.net mvc 5 project in visual studio 2015 professional
And I have added meta tag in my layout for Content Security Policy as -

<meta http-equiv="content-security-policy"
content="default-src 'none'; script-src 'self';
connect-src 'self'; img-src 'self'; style-src 'self';" />


Now when I run my application I get following error in chrome browser console -


Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-CwE3Bg0VYQOIdNAkbB/Btdkhul49qZuwgNCMPgNY5zw='), or a nonce ('nonce-...') is required to enable inline execution.
modernizr-2.6.2.js:157


There are 6 errors for modernizr-2.6.2.js:157 and one is related to script, i.e. refused to load the script localhost

I don’t think I have any inline style in my project and then why CSP refused to apply error ?

Answer Source

Apparently modernizr either injects a style element with some CSS properties, or else injects some style attributes; you can deal with it by changing your CSP policy this:

<meta http-equiv="content-security-policy"
  content="default-src 'none'; script-src 'self';
  connect-src 'self'; img-src 'self';
  style-src 'self' 'sha256-CwE3Bg0VYQOIdNAkbB/Btdkhul49qZuwgNCMPgNY5zw=';" />
Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download