【发布时间】：2017-07-12 13:40:57
【问题描述】：
我刚刚从 Angular1.6 -> 4 升级，我有点卡住 Content-Security-Protocol 错误：
http://localhost:4200/:1 GET http://localhost:4200/ 404 (Not Found)
localhost/:1 Refused to load the font 'data:font/woff;base64,d09GRgABAAAAAIt0ABEAAAABQDwAAQABAAAAAAAAAAAAAAAAAAAAACwKGBmIIpVWLACJWGwAUVjI2KwAiNEswkKAwIrswsQAwIrsxEWAwIrWbIEKAZFUkSzCxAEAisA'
because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
就像我尽我所能并让我发布我的 JSON 文件一样！就像有人可以帮助我了解到底发生了什么，为什么它不起作用以及其他可能的解决方案？而且，我还没有尝试使用 manifest.JSON.... 我对这个项目有点兴趣，所以任何帮助都将不胜感激！
<!doctype html>
<html lang="en">
<head>
<meta http-equiv="Content-Security-Policy" content="
default-src 'none';
style-src 'self' 'unsafe-inline';
font-src * data:;
" />
<meta charset="utf-8">
<title>Comp</title>
<base href="/">
<!-- Latest compiled and minified CSS -->
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css">
<!-- jQuery library -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
<!-- Latest compiled JavaScript -->
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/x-icon" href="favicon.ico">
</head>
<body>
<app-root></app-root>
</body>
</html>
包.JSON：
{
"name": "comp",
"version": "0.0.0",
"license": "MIT",
"scripts": {
"ng": "ng",
"start": "ng serve && node app.js",
"build": "ng build",
"test": "ng test",
"lint": "ng lint",
"e2e": "ng e2e"
},
"private": true,
"dependencies": {
"@angular/animations": "^4.0.0",
"@angular/common": "^4.0.0",
"@angular/compiler": "^4.0.0",
"@angular/compiler-cli": "^4.2.6",
"@angular/core": "^4.0.0",
"@angular/forms": "^4.0.0",
"@angular/http": "^4.0.0",
"@angular/platform-browser": "^4.0.0",
"@angular/platform-browser-dynamic": "^4.0.0",
"@angular/router": "^4.0.0",
"core-js": "^2.4.1",
"module": "^1.2.5",
"mongodb": "^2.2.30",
"mongoose": "^4.11.1",
"mongoose-middleware": "^1.0.0",
"ng2-dnd": "^4.2.0",
"rxjs": "^5.1.0",
"zone.js": "^0.8.4"
},
"devDependencies": {
"@angular/cli": "^1.2.0",
"@angular/language-service": "^4.0.0",
"@types/jasmine": "~2.5.53",
"@types/jasminewd2": "~2.0.2",
"@types/mongodb": "^2.2.7",
"@types/node": "^8.0.10",
"body-parser": "^1.17.2",
"codelyzer": "~3.1.2",
"jasmine-core": "~2.6.2",
"jasmine-spec-reporter": "~4.1.0",
"karma": "~1.7.0",
"karma-chrome-launcher": "~2.2.0",
"karma-cli": "~1.0.1",
"karma-coverage-istanbul-reporter": "^1.2.1",
"karma-jasmine": "~1.1.0",
"karma-jasmine-html-reporter": "^0.2.2",
"protractor": "~5.1.2",
"ts-node": "~3.2.0",
"tslint": "~5.5.0",
"typescript": "~2.4.1"
}
}
【问题讨论】：
-
听起来您的 Content-Security-Policy 标头具有比您尝试在文档中使用该元元素设置的更严格的策略。您不能以这种方式设置不太严格的政策。您需要更改标题值。见stackoverflow.com/questions/42960811/… 和stackoverflow.com/questions/44732431/…
-
有什么想法可以在哪里定义这个更严格的政策？
-
这完全取决于您运行的服务器软件。如果服务器正在运行 Apache，它可能位于 .htaccess 文件中，也可能位于系统 /etc/apache2/apache2.conf 文件或 /etc/apache2/ 目录中的其他文件中。如果服务器正在运行 nginx，它可能在 /etc/nginx/nginx.conf 文件或 /etc/nginx/ 目录中的其他文件中……等等。
-
刚刚想通了，长话短说：来自一个模块...谢谢！
标签： angular google-chrome content-security-policy