Avoiding `script-src 'unsafe-inline'` with Content-Security-Policy and JavaScript

Question

I have a trouble with settings Content-Security-Policy

I have .html file, external .css and external .js

Here is example: http://kod.djpw.cz/kmxc

Without Content-Security-Policy page works. If I set:

Header set Content-Security-Policy "default-src 'none'; child-src 'self'; connect-src 'self'; script-src 'self'; base-uri 'self'; style-src 'self'; block-all-mixed-content; upgrade-insecure-requests; frame-ancestors 'none'; object-src 'self'; img-src 'self'; media-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self';"

There is a problem with JavaScript. It does not work. When I rewrite script-src 'unsafe-inline' - my page works... (As without CPS settings). But it is unsafe...

How can I do external working .js with safety settings in CPS?

onclick="openModal();currentSlide(2)" that will open 2th image (or onclick="currentSlide(2)") and make close onclick="closeModal()"

Quentin · Accepted Answer · 2020-07-19 16:17:20Z

2

Bind your event handlers with addEventListener instead of using intrinsic event attributes.

document
  .querySelector("#element-id")
  .addEventListener("click", closeModal);

answered Jul 19, 2020 at 16:17

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

TheWuif · Accepted Answer · 2020-07-19 16:19:46Z

2

you can't set script-src 'self' and use inline JS. You have to define the EventListeners in a JS-File, or you will have to disable this policy.

https://developer.mozilla.org/de/docs/Web/API/EventTarget/addEventListener

answered Jul 19, 2020 at 16:19

TheWuif

1,0469 silver badges11 bronze badges

Collectives™ on Stack Overflow

Avoiding `script-src 'unsafe-inline'` with Content-Security-Policy and JavaScript

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related