In my express js application I have enabled the helmet for the security implementation
const app = express();
app.use(function (req, res, next) {
res.header("Access-Control-Allow-Origin", "*");
res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
next();
});
app.use(helmet(
));
After setting this i m getting CSP error in chrome console
Refused to load the script 'https://code.jquery.com/jquery-3.4.1.min.js' because it violates the following Content Security Policy directive: "script-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
localhost/:1
to resolve this I have added the following meta tag
<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://code.jquery.com/">
But still I m getting the error, i tried similar posts in the StackOverflow but nothing resolved my problem
Figure it out the issue i have to set the CSP through helmet configuration
app.use(helmet.contentSecurityPolicy({
useDefaults: false,
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'", "'unsafe-inline'","code.jquery.com","*.jsdelivr.net"],
"style-src":["'self'","'unsafe-inline'","*.cloudflare.com","*.googleapis.com","*.jsdelivr.net"],
"font-src":["'self'","*.gstatic.com","*.cloudflare.com","*.jsdelivr.net"],
"img-src":["'self'","data:"]
}
}));