Content Security Policy directive violated on a simple website

Question

Sorry to bother you but I'm working on my personnal website and trying to integrate a Google Map (thank you codepen for the great templates).

But I have to face a recurrent CSP error message, leading the map not to load:

Refused to load the script 'https://maps.googleapis.com/maps/api/js?key=AIzaSyBlSsS5JzdJLsuMEY24xeLAZOc7JAH6sr8' because it violates the following Content Security Policy directive: "script-src 'self' www.google-analytics.com".

I made reseaches before asking my question, as it seems to be a problem for quite some people. I tried everything, including removing the Google Analytics script and addind this:

<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://apis.google.com https://maps.googleapis.com https://maps.gstatic.com www.google-analytics.com ajax.googleapis.com; object-src 'self'">

But it didn't change anything. My map won't load, and it kind of pisses me of !

Do you have any idea what I made wrong ? Thanks a lot for your help ! (if needed, I can show you the error in live, but I don't want to "promote" my site here)

@RichO'Kelly you obviously meant the code... Stupid me. Here you are: https://drive.google.com/folderview?id=0B05bkTIQj7DBZXF4bWRILXp5UlE&usp=sharing — Aymeric Bazire, Jan 11 '16 at 14:53
Possible duplicate of [Refused to load the script because it violates the following Content Security Policy directive](https://stackoverflow.com/q/31211359/608639) — jww, Oct 19 '18 at 06:42

score 2 · Accepted Answer · answered Jan 11 '16 at 15:50

2

Line 479 of your .htaccess file says:

Header set Content-Security-Policy "script-src 'self' www.google-analytics.com"

Not sure your meta tag can override this.

You should probably modify that line in your .htaccess file instead, to include your other sources (in the case of Google Maps, "https://maps.googleapis.com").

answered Jan 11 '16 at 15:50

ghybs

47,565
6
74
99

Thank you very much I would have never found out without you ! – Aymeric Bazire Jan 11 '16 at 17:49
De rien et bon courage ! :-) – ghybs Jan 11 '16 at 18:21

Content Security Policy directive violated on a simple website

1 Answers1