Search code examples
liferaycontent-security-policy

Content security policy causes error in Liferay 7 project

As part of new security requirement from the client I have added "Content Security Policy" in my Liferay application:

response.setHeader(
    "Content-Security-Policy",
    "default-src 'none'; script-src 'unsafe-inline' *.googleapis.com; style-src 'self' *.googleapis.com;font-src 'self' *.gstatic.com;connect-src ; img-src 'self' data:;base-uri 'none';frame-ancestors 'none';");

But I am getting below error

Refused to load the script 'http://localhost:8080/o/js_loader_modules?t=1536146336645' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' *.googleapis.com".

Local server up and running localhost:8080. How to solve this?

Solution

  • It looks like CSP blocks your own script from loading and only allows inline <script> tags from googleapis.com. You should try adding 'self' to your CSP rules, because it means you can use scripts from your own domain.

    script-src 'self' 'unsafe-inline' *.googleapis.com;