<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script>
However I still receive in Chrome:
Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'sha256-1DCfk1NYWuHM8DgTqlkOta97gzK+oBDDv4s7woGaPIY='". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.
I've toyed with this for over an hour but still am unable to generate a hash that matches examples eg.
<script>alert('Allowed to execute');</script> (hard to determine original spacing) has hash of
Which doesn't make much sense: the last part doesn't start with
sha256-, but at least the first hash is the correct length. I get
sha256-nbFv/38jW7zf8mQirwFemFjDwp5CwIaorxe4Z3yycn0= as the hash for
alert('Allowed to execute');
<script>console.log("Hello world");</script> should have a csp of
script-src 'sha256-y/mJvKQC/3H1UwsYAtTR7Q==' eyeballing it, that looks too short.
What am I doing wrong?