Question

错误：

Uncaught Template render error: (result.html)
  EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src *".

nginx配置：

[..]
more_set_headers   "Content-Security-Policy:
                default-src * 'unsafe-eval' 'unsave-inline';
                script-src 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-inline' https://cdn.raygun.io https://cdn.segment.com https://platform.instagram.com https://www.google-analytics.com https://cdn.mxpnl.com https://maxcdn.bootstrapcdn.com;
                connect-src 'self'  https://api.raygun.io https://api.parse.com https://api.segment.io https://api.mixpanel.com;
                img-src 'self' data: https://*.amazonaws.com https://www.google-analytics.com https://*.akamaihd.net https://www.google.com https://*.licdn.com;
                style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com;
                font-src 'self' https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com;
                frame-src https://instagram.com";
[..]

问题：

看起来未应用nginx配置中设置的 Content-Security-Policy 。我检查了从服务器返回的标头，它们设置正确（包括unsafe-inline和unsafe-eval）。

问题：

帮助？或者更详细：我还需要做些什么才能让Chrome渲染我的 nunjuncks 模板？

我正在寻找一个适用于服务器端的解决方案（没有Chrome插件）。

Answer 1

我错过了

<meta http-equiv="Content-Security-Policy" content="default-src *">

在模板中，grrrr！

由于Content-Security-Policy，nunjuncks无法呈现

1 个答案: