I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one.

The relevant part of my .htaccess file is script-src 'self'. Here I do not set 'unsafe-inline' as that kind of goes against the point of setting the CSP in the first place - at least in my reading.

With Craft setting a CSRF token and my site doing POST requests over AJAX, I set the token name and value as recommended here: https://craftcms.com/support/csrf-protection - which is inline and above in my CSP I do not allow inline scripts. So as you can see it falls apart and Craft spits out a 400 error.

Is there any way I can get around this? I'd like to keep my CSP and with CSRF being enabled by default in Craft 3, I'd like this ironed out before then.

  • While my question still stands, I have had to can my CSP due to the incompatibility I was facing with CSRF. If anyone can provide some insight around this I would be forever grateful.
    – rjdvsk
    Mar 7 '17 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.