I have an img tag on a page with an line style that looks like this:
I can't move it to an external stylesheet because the img tag is generated by a 3rd party control. So I copied the hash displayed in Chrome developer tools.
Part of the Content-Security-Policy looks like this:
style-src 'self' 'sha256-7kYG54iPGE/Vf+GFqobEwpF9bfCAVA/elCz7OiSmMl0=';
But Chrome still blocks it with the following message:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'sha256-7kYG54iPGE/Vf+GFqobEwpF9bfCAVA/elCz7OiSmMl0='". Either the 'unsafe-inline' keyword, a hash ('sha256-7kYG54iPGE/Vf+GFqobEwpF9bfCAVA/elCz7OiSmMl0='), or a nonce ('nonce-...') is required to enable inline execution.
The hash in the policy matches the required hash in the error message. Why is Chrome still blocking it?