Google API Sign-In using auth2 fails with error: Refused to execute inline script because it violates the following Content Security Policy directive #463
Description
Hi,
This error may sometime happen, maybe roughly 1 in 10.
User clicks the Google Sign-In button, the Google Sign-In pops up and user authorize. An error is thrown and the sign-in fails.
The error:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'report-sample' 'nonce-zliYOlwerV1MslRE5pQXs8J5g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.
The codes used that throws the error:
Programmatically loading google api asynchronously from another external js file, for example:
// myscript.js
var d = document;
var t = 'script';
var o = d.createElement(t);
var s = d.getElementsByTagName(t)[0];
o.src = 'https://apis.google.com/js/api:client.js';
o.addEventListener('load', function(e) {
gapi.load('auth2', function() {
var a = gapi.auth2.init({
client_id: 'my-client-id.apps.googleusercontent.com',
scope : 'profile email'
});
a.isSignedIn.listen(function(v) {
// process sign-in state changes
});
a.currentUser.listen(function(v) {
// process changes to current user
});
document.getElementById('myCustomGoogleSignInButton').onclick = function() {
a.signIn();
};
});
}, false);