javascript - Stripe Connect : Content Security Policy issue

Solution:

Your CSP has a lot of errors:

1. You have missed semicolons; to separatescript-src /connect-src /frame-src directives lists.

2. : is nor required in theconnect-src : * ... and in theframe-src : * ...

3. Remove'unsafe-inline' and'unsafe-eval' from theconnect-src andframe-src directives, those are not supported there

4. The* (asterisk) covers any host-sources likehttps://checkout.stripe.com andwss://checkout.stripe.com

BUT these are not significant, these just leads the CSP you have really is:

default-src *; 
style-src 'self'  'unsafe-inline'; 
script-src * 'self' 'unsafe-inline' 'unsafe-eval'
Copy code

This CSP restrict nothing exceptdata:-Urls usage. Therefore the error:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)
Copy code

cannot belong your CSP.
Looks like you already have CSP header published somewhere. Hence second CSP via<meta> or HTTP header does not have effect as expected.

Check what CSP header you really have got in browser, the tutorial is here.

Check web-server config in Nginx foradd_header Content-Security-Policy ... or.htaccess file (if Apache) forHeader set Content-Security-Policy ... presence.
Or maybe you have installed some plugins for managing CSP headers.

Didn't find the answer?

Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.