我在我的Laravel
应用程序中使用Stripe
,Vue
在前面,我在标题部分添加<script src="https://js.stripe.com/v3/"></script>
,一切都很好。最近我在我的console.log
中收到以下安全警告。
Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='".
this问题描述了Reactjs
中的相同问题,但没有解决方案。
更新:添加像这样的 meta标记,<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-eval' https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='"/>
不允许其他脚本运行,并导致此控制台错误Refused to load the script '<URL>' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' <URL> 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
1条答案
按热度按时间4jb9z9bj1#
可以添加此CSP(内容安全策略)指令
"script-src 'self' 'unsafe-eval' https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='