1561924 - Content Security Policy messages are not really helpful

Status: RESOLVED INCOMPLETE

(Core :: DOM: Security, enhancement, P3)

Description

[Mathieu Leplatre [:leplatrem]]

While loading my Web page I can see this message in the Console:
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“default-src”).

It does not say anything else (resource? is it script? style?).
And it's really hard to figure out what should be done.

I opened it in Chromium and could read this: Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-TYbwAL1uG5EtDAXm/G5TBQKUeiNI1JIfLMh/yMtxDNM='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

That is slightly more helpful!

I now know it's about a style and that it uses default-src because nothing was explicitly set.

That's it, a quick feedback for some improvement areas ;)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

I know, we are working on it -> see bug 1242016.

Comment 2

[Tom Schuster (MoCo)]

We are working on improving the error messages in other bugs, this doesn't really provide anything new.