JavaScript Problem

[rajdis]

After using Content-Security-Policy(CSP) the javascriptsfrom other sources are not working properly. What can I do?

 

Part of my .htaccess is:

 

Header set Strict-Transport-Security "max-age=631138519; includeSubDomains"
Header unset Content-Security-Policy
Header set Content-Security-Policy "script-src 'self' 'https://apis.google.com' 'https://www.googletagmanager.com/' 'https://ajax.googleapis.com' 'https://maxcdn.bootstrapcdn.com' 'https://cse.google.com/'"
Header unset X-Content-Security-Policy
Header set X-Content-Security-Policy "default-src 'self' 'https://apis.google.com' 'https://www.googletagmanager.com/' 'https://ajax.googleapis.com 'https://maxcdn.bootstrapcdn.com' 'https://cse.google.com/'"
Header unset X-WebKit-CSP
Header set X-WebKit-CSP "default-src 'self' 'https://apis.google.com' 'https://www.googletagmanager.com/' 'https://ajax.googleapis.com' 'https://maxcdn.bootstrapcdn.com' 'https://cse.google.com/'"
Header unset Referrer-Policy
Header set Referrer-Policy: strict-origin-when-cross-origin

 

 

Edit: The CSS are working

Edited July 29, 2018 by rajdis

[rajdis]

Anyone here? ;_;

[wolstech]

We haven't been paying much attention up here the past few days due to the hack...sorry about that. Try removing the single quotes around the URLs. Also, try removing all of the URLs except one, and see if the matching script loads (with all others being expected to fail). If so, add a second URL, and repeat.

 

Also, your site does use inline scripting which is blocked when using CSP, so your site is going to break to an extent even when it works correctly.

[rajdis]

I am getting this following error:

 

17:00:54.506 Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src https://distribure.cf https://apis.google.com https://www.googletagmanager.com https://ajax.googleapis.com https://maxcdn.bootstrapcdn.com https://cse.google.com”). Source:
  window.dataLayer = window.dataLayer |.... 1 web_design.php:117
 

The updated .htaccess is:

 

Header set Content-Security-Policy "script-src 'self' https://apis.google.com https://www.googletagmanager.com https://ajax.googleapis.com https://maxcdn.bootstrapcdn.com https://cse.google.com ;"

[wolstech]

I did some digging last night and you're not the first to have this issue here...someone else ran into this a while back too. No fix was ever found.

 

Reports on Google show success sending these using PHP's header() function, perhaps that's an option? Make a file with the code and require() in all relevant pages.

[rajdis]

Okay.

I will try that.

The CSP is currently removed as I was too much problem in adding JSPs.