javascript - Angular 应用程序中的 Google Chrome "Refused to load the script"错误

Question

我在 Chrome Dev Console 上观察到以下错误，即使使用隐身窗口也是如此:

拒绝加载脚本 'https://localhost:5001/_framework/aspnetcore-browser-refresh.js' 因为它违反了以下内容安全策略指令:“script-src 'sha256-ZT3q7lL9GXNGhPTB1Vvrvds2xw/kOV0zoeok2tiV23I ='”。请注意，“script-src-elem”未明确设置，因此“script-src”用作后备。

我查看了原因，并报告了常见的浏览器扩展，但在隐身窗口中，没有任何扩展等。那么，是否有与该问题相关的解决方案？

Answer 1

尝试更改安全策略，例如:

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' https://localhost:5001 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'" />

或者只是

<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://localhost:5001 'unsafe-inline' 'unsafe-eval'" />

Chrome 有 CSP(内容安全策略)。

• You can't use inline scripting in your Chrome App pages. The restriction bans both blocks and event handlers ().
• You can't reference any external resources in any of your app files (except for video and audio resources). You can't embed external resources in an iframe.
• You can't use string-to-JavaScript methods like eval() and new Function().

这是策略值:

default-src 'self';
connect-src * data: blob: filesystem:;
style-src 'self' data: 'unsafe-inline';
img-src 'self' data:;
frame-src 'self' data:;
font-src 'self' data:;
media-src * data: blob: filesystem:;

More infomation