Laravel和条纹:拒绝将字符串作为JavaScript计算,因为“unsafe-eval”不是允许的脚本源

p5fdfcr1  于 2023-02-21  发布在  Java
关注(0)|答案(1)|浏览(236)

我在我的Laravel应用程序中使用StripeVue在前面,我在标题部分添加<script src="https://js.stripe.com/v3/"></script>,一切都很好。最近我在我的console.log中收到以下安全警告。

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='".

this问题描述了Reactjs中的相同问题,但没有解决方案。
更新:添加像这样的 meta标记,<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-eval' https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='"/>不允许其他脚本运行,并导致此控制台错误
Refused to load the script '<URL>' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' <URL> 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

4jb9z9bj

4jb9z9bj1#

可以添加此CSP(内容安全策略)指令"script-src 'self' 'unsafe-eval' https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='

相关问题