CSP Issues

[ArbaazN]

Steps to reproduce

Can You Guide how to CSP issue while using it as i am using strict csp

What is expected?

CSP Resolution

What is actually happening?

How to Resolve CSP Issue

Additional data

[Vatsal6288]

Hello @ArbaazN,

Thank you for reaching out to us!

To better assist you, could you please provide more details about the issue you're experiencing? This will help us understand the problem and work towards a reliable solution for you.

We look forward to your response.

[ArbaazN]

Refused to load the stylesheet 'https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&ampdisplay=swap' because it violates the following Content Security Policy directive: "style-src 'self'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.
Understand this error
helpers.js:1 Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

at ./js/helpers.js (helpers.js:1:389)
at helpers.js:1:32258
at helpers.js:1:32322
at helpers.js:1:158
at helpers.js:1:223

./js/helpers.js @ helpers.js:1
(anonymous) @ helpers.js:1
(anonymous) @ helpers.js:1
(anonymous) @ helpers.js:1
(anonymous) @ helpers.js:1Understand this error
config.js:15 Uncaught TypeError: Cannot read properties of undefined (reading 'getCssVar')
at config.js:15:29
(anonymous) @ config.js:15Understand this error
crm.webiknows.net/:557 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-GGtNTm4eUGET48KLsS6Cf0J0MI3L8A9EWdzd9JiWXjU='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Understand this error
crm.webiknows.net/:564 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-pKjM1+x07UAa6rRMtRmmW10ObnugQCrNjEcITvfsegg='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Understand this error
crm.webiknows.net/:580 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-GGtNTm4eUGET48KLsS6Cf0J0MI3L8A9EWdzd9JiWXjU='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Understand this error
crm.webiknows.net/:587 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-pKjM1+x07UAa6rRMtRmmW10ObnugQCrNjEcITvfsegg='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Understand this error
crm.webiknows.net/:603 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-GGtNTm4eUGET48KLsS6Cf0J0MI3L8A9EWdzd9JiWXjU='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Understand this error
crm.webiknows.net/:610 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-pKjM1+x07UAa6rRMtRmmW10ObnugQCrNjEcITvfsegg='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Understand this error
main.js:38 Uncaught TypeError: Cannot read properties of undefined (reading 'scrollToActive')
at main.js:38:20
at NodeList.forEach ()
at main.js:32:16
at main.js:138:3
(anonymous) @ main.js:38
(anonymous) @ main.js:32
(anonymous) @ main.js:138Understand this error
dashboards-analytics.js:24 Uncaught ReferenceError: config is not defined
at dashboards-analytics.js:24:3
at dashboards-analytics.js:418:3
(anonymous) @ dashboards-analytics.js:24
(anonymous) @ dashboards-analytics.js:418Understand this error
buttons.js:6 Refused to connect to 'https://api.github.com/repos/themeselection/materio-bootstrap-html-admin-template-free' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

F @ buttons.js:6
E @ buttons.js:6
T @ buttons.js:6
(anonymous) @ buttons.js:6
u @ buttons.js:6
(anonymous) @ buttons.js:6
(anonymous) @ buttons.js:6
r @ buttons.js:6Understand this error
buttons.js:6 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-qo7STIM1L/OgU9y0De47mqod1UZFLJfTn36bRC42rfA='), or a nonce ('nonce-...') is required to enable inline execution.

[ArbaazN]

Hi
This Csp I am trying to use in application but due use of inline css in predefine js file it is giving me error
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:"

[Vatsal6288]

Hello @ArbaazN,

Thank you for your response.

Our theme utilizes Google Fonts for typography. If you're experiencing issues with web fonts, you can host them locally as a workaround. However, please note that we are unable to assist with this process, and it will need to be handled on your end.

For detailed instructions on how to host Google Fonts locally, you can refer to this guide:-
Self-hosting Google Fonts: https://fonts.google.com/knowledge/using_type/self_hosting_web_fonts

If you have any further questions, feel free to reach out.

[ArbaazN]

Thanks for your help but I am looking for the JS finally shoes with respect to CSP that is menu better JS and other bootstrap js I am also checks but I can solve the internally but I can't find any solution for the CSP issue that is related to the JS file so can you help me with that this files are used for adding inline CSS to the code

[Vatsal6288]

Hello @ArbaazN,

We're glad to hear that your issue with the fonts has been resolved.

Please note that we use third-party libraries in some areas of our application. If you're experiencing issues related to their JavaScript, you may choose to remove or replace those libraries at your discretion. However, please be aware that we’re unable to provide support for custom modifications involving third-party code.

If you have any other questions or need further assistance, feel free to reach out.

[github-actions]

This issue has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Thank you for raising the concern.