Content-Security-Policy + Angular 8

Question

I am applying the following security policy in a project:

<meta http-equiv="Content-Security-Policy" content="script-src 'self'; style-src 'self'; img-src 'self';" />

On the console, I get the following errors:

I’ve tried to use:

npm build --prod npm run build --prod npm build --aot --prod

None of the other options worked. Has anyone gone through anything like this?

Answer 1

So Angular can apply dynamic styles to the elements in the keyword style-src you must complement with 'unsafe-inline'

<meta http-equiv="Content-Security-Policy" content="script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self';" />