Forum Discussion
No RepliesBe the first to reply
Related Content
- 2 months ago
- 9 months ago
- 6 years ago
- 2 years ago
Recent Discussions
- 8 hours ago
We are using the following CSP header in our application: "script-src https: 'self';"
However, when using the above CSP header, Swagger UI fails to load with an error in the console saying that Swagger UI requires either unsafe-eval, unsafe-inline, sha or nonce in the script-src CSP header.
When adding them, "script-src https: 'unsafe-eval' 'unsafe-inline' 'self';", the Swagger UI works fine, but this deletes the purpose of hardening security using CSP headers.