In CSP header Chrome says my single quoted sha256 hash contains invalid characters but this looks incorrect

user_3931173 0
Viewed 9555

I have a number of sha256 hashes in the script source. chrome gives me this error on the first one;

The Content-Security-Policy directive name ''sha256-OIf-redacted-bJEXc='' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.

The redacted section consists ONLY of a-zA-Z0-9\-

If I remove the quotes ( the only non-compliant character ) it doesn't recognise the section at all.

I'm led to believe that the error message is misleading and there is something else wrong with the hashes.

What is the true problem here? Why will chrome not accept these directives?

The header looks like this: default-src 'none'; script-src 'self' https://consentcdn.cookiebot.com/ https://consent.cookiebot.com/ ; 'sha256-e-redacted-A=' ...more stuff...

content-security-policy google-chrome
1 Answers

Chrome thinks your hash is a directive.

You should first insert the directive, which would be script-src or default-src in your case, then you add your sources, such as the hash, 'self' or specified domains.

It seems like you are inserting a source like a directive. The structure of a CSP is <directive> <source> ... <source>; <directive> <source> ... <source>; ... See also https://content-security-policy.com/

user_92393110
Related