New answers tagged


From the documentation of style-src: '<hash-algorithm>-<base64-value>' A sha256, sha384 or sha512 hash of scripts or styles. ... In CSP 2.0 this applied only to inline scripts. CSP 3.0 allows it in the case of script-src for external scripts. So based on this the hashing specification cannot be used for external styles but only for inline ...


The X-DNS-Prefetch-Control HTTP response header controls DNS-prefetching of <a href> elements on hover. It has nothing to do with <link rel="dns-prefetch"> mechanism.


It looks like that with Chrome (but not Firefox) you also need to explicitly allow 'unsafe-hashes' since giving the hashes alone seem to apply only for script and style sections and not attributes. See 8.3. Usage of "'unsafe-hashes'". With that your CSP should look like this: style-src 'self' 'unsafe-hashes' 'sha256-7kYG54iPGE/Vf+GFqobEwpF9bfCAVA/...

Top 50 recent answers are included