Refused to load the script : Content-Security-Policy

Question

Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/axios/0.18.0/axios.min.js' because it violates the following Content Security Policy directive: "script-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

**script(src='https://cdnjs.cloudflare.com/ajax/libs/axios/0.18.0/axios.min.js')**

so i tried adding this meta header though it throws the same error

meta(http-equiv='Content-Security-Policy' content="script-src 'self' https://cdnjs.cloudflare.com/ 'unsafe-inline' 'unsafe-eval'")

Answer 1

if you are using helmet in node then this worked for me

app.use( helmet({ contentSecurityPolicy: false }) );

Answer 2

You likely have a default Content Security Policy served as a response header. Adding another policy in meta tag can only make it stricter as all content needs to pass all policies. You need to identify what sets the CSP with "script-src 'self'" and modify that policy.