2

Hi i have some content security policy like this:

<meta http-equiv="content-security-policy" content="default-src 'self';
    script-src 'self' 'nonce-MhqUJrKKq9' https://ajax.googleapis.com/ajax/libs/webfont/1.6.16/webfont.js;
    style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; font-src 'self' https://fonts.gstatic.com/;
    object-src 'none'; base-uri 'none';">

I was try to allow a google fonts, but it give me this error:

webfont.js:17 Refused to load the stylesheet 'http://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700%7CRoboto:300,400,500,600,700' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/".

so what can caused this error? i though i already exclude it from my policy.

4
  • Try google fonts without https , 'fonts.googleapis.com/…' Jun 30, 2018 at 16:34
  • 1
    You need to use the https URL: https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700%7CRoboto:300,400,500,600,700. (The error message in the question indicate your code is calling the http URL.)
    – sideshowbarker
    Jun 30, 2018 at 16:34
  • @ishwarchandratiwari ah thanks it work you can put in answer if you want to so i can select it.
    – Ying
    Jun 30, 2018 at 16:41
  • @sideshowbarker ah thank you, i still testing on my local never thought that i would cause a trouble. thank you.
    – Ying
    Jun 30, 2018 at 16:42

1 Answer 1

0

Try google fonts without https , http://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700%7CRoboto:300,400,500,600,700%27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.