After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application.
Our current header is set as mentioned below-
Server: Apache X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes Content-Length: 151 Last-Modified: Wed, 04 Apr 2018 08:18:16 GMT X-Powered-By: Servlet/2.5 JSP/2.1 Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com www.google.com *.google-analytics.com ; img-src 'self' data: ; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-XSS-Protection: 1; mode=block Content-Type: text/html
Can you please help to understand how the issue can be resolved? We tried nonce approach also but couldn't get succeed we are left with below issue
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-1vb337j47ngp6'". Either the 'unsafe-inline' keyword, a hash ('sha256-mf8m/qIWtvEARCPQ2lxzyNeJ+xiFw84zHgmCq5rxqbo='), or a nonce ('nonce-...') is required to enable inline execution.