1
我有一个Nginx的CSP配置如下:Nginx的CSP框架-SRC忽略
add_header Content-Security-Policy "default-src 'self';script-src 'self' 'unsafe-eval' https://www.google-analytics.com/analytics.js;img-src 'self' https://ssl.google-analytics.com data:;style-src 'self' 'unsafe-inline';font-src 'self' 'unsafe-inline';frame-src 'self' https:;object-src 'self';connect-src 'self' ws:;media-src 'self'
当我尝试在Chrome加载网页我看到:
Refused to frame 'https://myexternalwebsite.com/a/b/index.html' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.
在我的CSP框架-SRC已明确设置并具有“自我”值,并且https:
我该做什么错?
如果将“https:”添加到默认策略中会发生什么? frame-src在CSP 2中已弃用,因此Chrome可能会忽略它? – seanwatson
检查浏览器收到的标题 –