javascript - Google Chrome "Refused to load the script" error in Angular application

Question

I have observed the following error on Chrome Dev Console even if using Incognito Window:

Refused to load the script 'https://localhost:5001/_framework/aspnetcore-browser-refresh.js' because it violates the following Content Security Policy directive: "script-src 'sha256-ZT3q7lL9GXNGhPTB1Vvrvds2xw/kOV0zoeok2tiV23I='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

I have a look at the causes and commonly browser extensions are reported, but in Incognito Window, there is not any extension, etc. So, any fix related to the problem?

question from:https://stackoverflow.com/questions/65907946/google-chrome-refused-to-load-the-script-error-in-angular-application

Answer 1

Try to change the security policy, for example:

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' https://localhost:5001 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'" />

Or only

<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://localhost:5001 'unsafe-inline' 'unsafe-eval'" />

Chrome has the CSP (Content Security Policy).

• You can't use inline scripting in your Chrome App pages. The restriction bans both blocks and event handlers ().
• You can't reference any external resources in any of your app files (except for video and audio resources). You can't embed external resources in an iframe.
• You can't use string-to-JavaScript methods like eval() and new Function().

Here is the policy value:

default-src 'self';
connect-src * data: blob: filesystem:;
style-src 'self' data: 'unsafe-inline';
img-src 'self' data:;
frame-src 'self' data:;
font-src 'self' data:;
media-src * data: blob: filesystem:;

More infomation