Your CSP has a lot of errors:
You have missed semicolons;
to separatescript-src
/connect-src
/frame-src
directives lists.
:
is nor required in theconnect-src : * ...
and in theframe-src : * ...
Remove'unsafe-inline'
and'unsafe-eval'
from theconnect-src
andframe-src
directives, those are not supported there
The*
(asterisk) covers any host-sources likehttps://checkout.stripe.com
andwss://checkout.stripe.com
BUT these are not significant, these just leads the CSP you have really is:
default-src *;
style-src 'self' 'unsafe-inline';
script-src * 'self' 'unsafe-inline' 'unsafe-eval'
This CSP restrict nothing exceptdata:
-Urls usage. Therefore the error:
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)
cannot belong your CSP.
Looks like you already have CSP header published somewhere. Hence second CSP via<meta>
or HTTP header does not have effect as expected.
Check what CSP header you really have got in browser, the tutorial is here.
Check web-server config in Nginx foradd_header Content-Security-Policy ...
or.htaccess
file (if Apache) forHeader set Content-Security-Policy ...
presence.
Or maybe you have installed some plugins for managing CSP headers.
You're missingimg-src https://*.stripe.com
described in the Stripe documentation.
Also the asterisk character alone doesn't work as "any resource" (example of incorrect use in your code:default-src *
). You need to use it as part of the<host-source>
(e.g.*.example.com
). See MDN docs for more details.
Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.
Find the answer in similar questions on our website.
Do you know the answer to this question? Write a quick response to it. With your help, we will make our community stronger.
PHP (from the English Hypertext Preprocessor - hypertext preprocessor) is a scripting programming language for developing web applications. Supported by most hosting providers, it is one of the most popular tools for creating dynamic websites.
The PHP scripting language has gained wide popularity due to its processing speed, simplicity, cross-platform, functionality and distribution of source codes under its own license.
https://www.php.net/
JavaScript is a multi-paradigm language that supports event-driven, functional, and mandatory (including object-oriented and prototype-based) programming types. Originally JavaScript was only used on the client side. JavaScript is now still used as a server-side programming language. To summarize, we can say that JavaScript is the language of the Internet.
https://www.javascript.com/
Welcome to the Q&A site for web developers. Here you can ask a question about the problem you are facing and get answers from other experts. We have created a user-friendly interface so that you can quickly and free of charge ask a question about a web programming problem. We also invite other experts to join our community and help other members who ask questions. In addition, you can use our search for questions with a solution.
Ask about the real problem you are facing. Describe in detail what you are doing and what you want to achieve.
Our goal is to create a strong community in which everyone will support each other. If you find a question and know the answer to it, help others with your knowledge.