Question

我正在我的网站上集成用于跟踪受众的Quantcast脚本。当页面在浏览器中加载时，我得到以下错误。我知道这是一个编码为base64的脚本，但是如何允许它使用CSP和CORS头执行呢？

拒绝加载脚本＆＃39;数据：应用/ JavaScript的; BASE64，ZnVuY3Rpb24gcXVhbnRzZXJ2ZSgpe30 =＆＃39; 因为它违反了以下内容安全策略指令：＆＃34; script-src＆＃39; self＆＃39; ＆＃39;不安全直插＆＃39; ＆＃39;不安全-EVAL＆＃39; * .cloudflare.com * .quantserve.com＆＃34;

这是我的标题：

headers {
    contentSecurityPolicy = "default-src 'self' *.cloudflare.com *.quantserve.com;"
    contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" img-src 'self' *.fbcdn.net *.twimg.com *.googleusercontent.com *.xingassets.com *.vk.com *.yimg.com secure.gravatar.com *.stuffpoint.com *.pixabay.com;"
    contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com maxcdn.bootstrapcdn.com cdn.jsdelivr.net fonts.googleapis.com edge.quantserve.com;;"
    contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" font-src 'self' fonts.gstatic.com fonts.googleapis.com cdnjs.cloudflare.com;"
    contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" script-src 'self' 'unsafe-inline' 'unsafe-eval' *.cloudflare.com *.quantserve.com;"
    contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" connect-src 'self' twitter.com *.xing.com;"
    contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" frame-src 'self' 'unsafe-inline' 'unsafe-eval' edge.quantserve.com;"
}

Answer 1

将data:添加到script-src行。

contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" script-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.cloudflare.com *.quantserve.com;"

注意：这通常会带来一些安全隐患，但您的script-src非常宽松，无论如何都无法提供保护。

Quantcast的CSP设置

1 个答案: