Helmet Rejects Localhost Even Though it is Included in Script-Src?

Question

I'm running my node.js web app at:

http://localhost:3000/

I'm getting this error from Helmet:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'unsafe-inline' 'sha256-DFWWwGm2cBwXA13nbn4jDkHCl2Oc/0Z2tKvKkN4NWj4=' http://localhost:3000/ http://localhost:4000/ [.....]". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.

http://localhost:3000/ is listed in the script-src directive. Why am I getting this error?

Helmet maintainer here. From the error message, it looks like you're trying to execute an inline script, which isn't allowed by your CSP. (You've included "unsafe-inline" which would normally allow it, but the SHA causes that to be ignored; see the last sentence in the error message.) — Evan Hahn
– Evan Hahn, Commented Apr 27, 2024 at 22:05
So that's what that hash is, and that's what inline script is. I can just include the hash in my CSP directives. Thanks, Evan. If you post this as an answer, I will mark it as the accepted answer. — VikR
– VikR, Commented Apr 28, 2024 at 1:05

Evan Hahn · Accepted Answer · 2024-04-28 14:08:43Z

1

From the error message, it looks like you're trying to execute an inline script, which isn't allowed by your CSP.

You've included "unsafe-inline" which would normally allow it, but the SHA causes that to be ignored; see the last sentence in the error message.

answered Apr 28, 2024 at 14:08

Evan Hahn

12.8k10 gold badges44 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Helmet Rejects Localhost Even Though it is Included in Script-Src?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related