I have a website in which I include several CSS stylesheets from my own server and one stylesheet from a remote server.

I wanted to write my Content Security Policy in a way to permit all local stylesheets, and only this one specific remote style sheets. This was my attempt:

style-src 'self' 'sha256-L/W5Wfqfa0sdBNIKN9cG6QA5F2qx4qICmU2VgLruv9Y='

However, upon navigating to my website, Chrome 78 claimed that the remote stylesheet does not match the existing Content Security Policy and refused to apply it. I looked at this similar question, where the solution was to apply 'unsafe-hashes', which did not solve my problem. It seems as if there is a difference between an externally included script and an inline script.

So my question is: Why does Chrome claim this script is not allowed? And what do I need to allow this script? (Aside from a generic whitelist for the domain)

1 Answer 1


From the documentation of style-src:

A sha256, sha384 or sha512 hash of scripts or styles. ... In CSP 2.0 this applied only to inline scripts. CSP 3.0 allows it in the case of script-src for external scripts.

So based on this the hashing specification cannot be used for external styles but only for inline styles. The behavior change with CSP 3.0 only allows external scripts this way but not external styles.

  • CSP 3.0 allows it in the case of script-src for external scripts. seems as if it's allowed for external scripts.
    – user163495
    Commented Dec 9, 2019 at 14:39
  • @MechMK1: yes, external scripts but not external styles. Commented Dec 9, 2019 at 15:04
  • Oh yes, you are right. So I assume my options are to just whitelist a whole CDN or to just distribute the css from my own server, right?
    – user163495
    Commented Dec 9, 2019 at 15:14
  • @MechMK1: yes, looks like these are your options. Commented Dec 9, 2019 at 15:18
  • 2
    @MechMK1 Also take a look at SRI and the integrity attribute : developer.mozilla.org/fr/docs/Web/Security/…
    – Xavier59
    Commented Dec 9, 2019 at 15:25

You must log in to answer this question.