-3

I just set up CSP on my WordPress website but I get many errors when I remove unsafe-inline and unsafe-eval. The problem is coming from log-in apps: Twitter first(big issue), Facebook and Google but these last 2 are good guys. I need to get rid of unsafe-inline and unsafe-eval but I can't disable inline scripts, or at the very least i'd like to allow Twitter, Facebook and Google to execute inline-scripts (is this risky?). This is my CSP:

<IfModule mod_headers.c>
    Header set Content-Security-Policy
    "default-src 'self' *.twitter.com ; 
    frame-src 'self' *.twitter.com platform.twitter.com web.facebook.com www.facebook.com staticxx.facebook.com accounts.google.com; 
    img-src 'self' data: https: *.gravatar.com *.twitter.com; 
    script-src 'self' *.twitter.com graph.facebook.com connect.facebook.net apis.google.com fonts.googleapis.com fonts.gstatic.com s0.wp.com 'unsafe-inline' 'unsafe-eval'; 
    style-src 'self' https: *.twitter.com fonts.googleapis.com 'unsafe-inline'; font-src 'self' data: https: *.twitter.com fonts.googleapis.com themes.googleusercontent.com; 
    object-src 'none';"
</IfModule>

Note that *.twitter.com is recurring many times because the log in app won't work otherwise.

Error log(when inline/eval are completely disabled):

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' *.twitter.com graph.facebook.com connect.facebook.net apis.google.com fonts.googleapis.com fonts.gstatic.com s0.wp.com ". Either the 'unsafe-inline' keyword, a hash ('sha256-KoZvlNi6WIlva5SMPsgkZKuz3pwSCUhpugmi7xxxxxx='), or a nonce ('nonce-...') is required to enable inline execution.
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https: *.twitter.com fonts.googleapis.com ". Either the 'unsafe-inline' keyword, a hash ('sha256-JVpnV+0aNm5M2eD8jhSLjDlD0zroEDG3MuRB/xxxxxx='), or a nonce ('nonce-...') is required to enable inline execution.

/* There are ca. 20 errors of this kind plus the following(which can be ignored) */

Uncaught ReferenceError: theChampVerified is not defined
    at combined.js:11
(anonymous) @ combined.js:11

Any suggestion to get rid of those unsafe-inline & unsafe-eval? Please tell me if you need more error logs or any other info. Any help is highly appreciated.

PS: someone should really add a 'Content-Security-Policy' tag <,<

closed as off-topic by Jacob Peattie, cjbj, Mark Kaplun, EAMann Feb 15 '18 at 16:00

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • This sounds more like a hosting, server, or server configuration issue and not an issue that is specific to WordPress. Would it not be a better topic to ask on Serverfault Exchange? – Howdy_McGee Jan 22 '18 at 23:43
  • The error message is pretty clear: "Either the 'unsafe-inline' keyword, a hash ('sha256-KoZvlNi6WIlva5SMPsgkZKuz3pwSCUhpugmi7xxxxxx='), or a nonce ('nonce-...') is required to enable inline execution". You should read more about Content Security Policy and nonces here: developers.google.com/web/fundamentals/security/csp – swissspidy Jan 23 '18 at 9:21
  • Thanks for the comments! I checked the links, and if I won't be able to fix this I'll try on Serverfault Exchange( i did not know of it's existence before ^^" ). I'll leave the question for a little while in case someone will be able to answer, giving the appropriate solution, so that other people who run into the same problem can have a clue of what's going on and the opportunity to learn something :) cheers (thanks to Howdy_McGee♦ for the revision) – JakeDD Jan 23 '18 at 20:08
1

Best way to fix this(the quickest,most secure and simple), unless you are ready to remove inline scripts, is adding "sha" to your CSP.

e.g. "script-src 'sha-r13fhahtt90sjkklieoxebnm/0900pqroo'"

Check from your browser console what is the "sha" that has to be added.

Not the answer you're looking for? Browse other questions tagged or ask your own question.