Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified

[wilbertku90]

Hi, I have been having problems with some notifications on Firefox(Version 67.0.2) with script-src, I tried several "solucions" but none of them works for me. Could you help me with this please?

There are the messages I get:

1. Content Security Policy: Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified
2. Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified
3. Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified

And I guess this prevent my contact form in Laravel to do the submission.

This is my current code on the secure-headers.php:
'script-src' => [
'allow' => [
$protocol.'code.jquery.com',
$protocol.'www.googletagmanager.com',
$protocol.'www.google-analytics.com',
$protocol.'www.google.com',
$protocol.'*.localhost',
],
$self' => true,
'unsafe-inline' => true,
'unsafe-eval' => true,
'data' => true,

        'hashes' => [
            // 'sha256' => [
            //     'hash-value',
            // ],
        ],

        'nonces' => [
            // 'base64-encoded',
        ],

        'schemes' => [
             'https:',
        ],

   'self' => true,

        'unsafe-inline' => true,

        'unsafe-eval' => true,
		
    'data' => true,
		
       //'strict-dynamic' => false,
         
       //'unsafe-hashed-attributes' => false,

        // https://www.chromestatus.com/feature/5792234276388864
        //'report-sample' => true,

        'add-generated-nonce' => false,
    ],

By the way, I'm doing the tests on my localhost(http://www.localhost:8000/) I hope you can help me with this issue,
Thanks!

[bepsvpt]

Hi @wilbertku90,

According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#strict-dynamic

At the same time, any whitelist or source expressions such as 'self' or 'unsafe-inline' will be ignored.

You can check out the link to see further information.

[bepsvpt]

Closed due to inactivity, feel free to open a new issue if you have any question.