I was hoping someone might have an idea. We're using CSP, and in DEV we use a library that calls to jQuery to add data to the page via AJAX calls. The call to add the data is being blocked by CSP.
I've added both nonce and hashes (separately) to the page that loads jQuery:
<script nonce="49rRAoaxuwp2CYgFdr6J0S0HRuh7IC3b" src='dist/js/jquery.min.js'>
or
<script src='dist/js/jquery.min.js' integrity='sha256-0eLJQuTW2D/xEnvGu7ZbhoOBHbMZWFTtwPHfZKrAJvc=' >
The library calls this line in jQuery, that is blocked by CSP:
(a.innerHTML = u[1] + w.htmlPrefilter(o) + u[2]),
Where a.innerHTML is blocked by CSP (style-src). It appears that the call is being done with different data, since the Hash of the script (in the Chrome console logs) changes on each call.
Can anyone suggest a work-around?