如何加载脚本以传递内容安全策略指令：default-src＆＃x27; none＆＃x27;？

Question

我有一个react+node.js应用程序在Localhost上工作正常，但是部署到Heroku时会遇到错误，从而产生404响应状态。

这些是我在Chrome上加载应用程序时遇到的控制台错误：

Refused to load the script 'https://ssl.google-analytics.com/ga.js' because it violates the following Content Security Policy directive: "default-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
(anonymous) @ 1:3

Refused to load the script 'https://www.pagespeed-mod.com/v1/taas?id=cs&ak=55c85bbdd6e4d21e7278fbbbb89a9502&si=fb4741a02e044f61940836e20590e7f6&tag=1005&rand=7e511f5336f16d2e87e9ac560e754a19&ord=7220108846457940' because it violates the following Content Security Policy directive: "default-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
(anonymous) @ 1:3

myapp.herokuapp.com/:1 Refused to load the stylesheet 'https://fonts.googleapis.com/css?family=Lato:300,400,700,900' because it violates the following Content Security Policy directive: "default-src 'none'". Note that 'style-src-elem' was not explicitly set, so 'default-src' is used as a fallback.

DevTools failed to load source map: Could not load content for chrome-extension://mihdfbecejheednfigjpdacgeilhlmnf/react-draggable.js.map: System error: net::ERR_BLOCKED_BY_CLIENT
myapp.herokuapp.com/:1  (warning)       

Failed to load resource: the server responded with a status of 404 (Not Found)

我尝试在public/index.html中添加scripts-src和style> style> style> style> style> style> style> style> sill>的修复程序。 subtest.json，src/server/index.js和app.js，但我总是看到相同的错误。

Frontend尝试修复：

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src-elem 'self' 'unsafe-inline' https://ssl.google-analytics.com https://www.pagespeed-mod.com; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com; object-src 'self'" />

后端尝试修复：

const helmet = require("helmet")
...
app.use(
  helmet({
    contentSecurityPolicy: false,
  })
)

Answer 1

策略“ default-src'none'”设置在某个地方，即使您尝试添加另一个策略，此策略仍始终适用并阻止所有内容。您将需要确定设置现有策略的位置，然后对其进行修改。