javascript - Refused to load the script because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'

Question

I am using MVC6 (asp.net 5) using angular and trying to load scripts from CDN locations when my code is running in release mode, but for some reason the scripts NEVER load.

I have read that you need to add a meta tag to your HTML file, which I have done, like so.

<meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' https://ajax.aspnetcdn.com; font-src 'self' http://netdna.bootstrapcdn.com" />

And on my Index.cshtml, I have got this.

<environment names="Staging,Production">
    <script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.8/angular.min.js"
        asp-fallback-src="~/lib/angular/angular.min.js"
        asp-fallback-test="window.angular">
    </script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/angular-ui-router/0.2.15/angular-ui-router.min.js"
        asp-fallback-src="~/lib/angular-ui-router/release/angular-ui-router.js"
        asp-fallback-test="window.angular && window.angularUiRouter">
    </script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/angular-local-storage/0.2.2/angular-local-storage.min.js"
        asp-fallback-src="~/lib/angular-local-storage/dist/angular-local-storage.js"
        asp-fallback-test="window.angular && window.localStorage">
    </script>

But they never load. I have tried running the code using IISExpress and also using the DNX Web command.

I have this post which is how I come to creating the META tag, but not sure why it's not working. I have tried this in Chrome, and under the console, I just get errors like so

Answer 1

Put the following in the web page header section:

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://cdnjs.cloudflare.com ">

More details about Content Security Policy you can read here and here.