[错误] CSP - 强制在 script-src 中使用 'unsafe-eval' - 2
作者: dioup创建于 2026年6月8日更新于 2026年7月27日
标签bug
SECURE_CSP = { "default-src": [CSP.SELF], "script-src": [ CSP.SELF, CSP.NONCE, "'WASM-unsafe-eval'", ], "connect-src": [ CSP.SELF, CSP.NONCE,
"https://cdn.jsdelivr.net/npm/cap-widget",
"https://cdn.jsdelivr.net/npm/@cap.js/",
"https://cdn.jsdelivr.net/npm/bootstrap",
"https://cap.eurecom.cafe/", ], "style-src": [ CSP.SELF, CSP.NONCE,
"'unsafe-hashes'",
"'sha256-MhtPZXr7+LpJUY5qtMutB+qWfQtMaPccfe7QXtCcEYc='",
], "img-src": [CSP.SELF, "data:"], "font-src": [ CSP.SELF, "https://cdn.jsdelivr.net/npm/[email protected]/font/fonts/", ], "script-src-elem": [CSP.SELF, "'unsafe-inline'", "https://cdn.jsdelivr.net", ], "style-src-elem": [ …
内容来源: tiagozip/cap