I'm trying to implement CSP, but cannot make the
script-src work correctly. I strongly want to avoid
unsafe-inline, but all attempts to circumvent this by using sha256 hashes seem to fail.
This is what happens: Several
When I click on such a modified link, I get a CSP violation report.
What confuses me slightly is that even if I temporarily use
Content-Securtity-Policy: and not just
Content-Securtity-Policy-Report-Only:, the website seems to function alright. I conclude that it is in fact the
It should be possible to get rid of the error by supplying a suitable hash. I tried both
#echo -n "void(0);" | openssl dgst -binary -sha256 | base64
but without success (i.e. even with
) the message still occurs.
What am I doing wrong?