Refused to apply inline style.. error Play 2.6

[Sebastian Janas]

Hi,

I'm new in Play framework and start is already difficult :(

Can someone help me with the security issue?

Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-Px7/U7FvVB0gdAHejj6zZ5qhvm1sCBXmO7rJkx3iyhE='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

Basically, chrome and firefox don't display  CSS style.

I will be grateful for any help

Thanks
Sebastian
 

[Justin du coeur]

This isn't a Play problem per se, aside from the fact that Play by default pushes you to use the current Web standards.  The error is coming from the browser, telling you that you are violating security.

See this page for more information:

https://www.playframework.com/documentation/2.6.x/SecurityHeaders

You're going to need to set up an appropriate play.filters.headers.contentSecurityPolicy setting in your config file, telling it to allow inline styles (which are forbidden by default on the modern Web, on security grounds), or pull the CSS out to a separate file...

--
Please join our new forum at https://discuss.playframework.com!
The play-framework Google Group will soon be put into read-only mode.
For details, see https://blog.playframework.com/introducing-discuss-playframework-com/.
---
You received this message because you are subscribed to the Google Groups "Play Framework [deprecated]" group.
To unsubscribe from this group and stop receiving emails from it, send an email to play-framework+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/play-framework/b174b1ae-544c-4870-ba03-d715f5891671%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Miguel Ángel Moreno]

Hello Sebastian

I dont remember how I reached to this headers.... but they are working

https://github.com/miguelsaddress/play-scala-slick-user-management-seed/blob/master/conf/common.conf#L96

I hope they let you get started. I also consider the framework hard to get started :)

Best,

Miguel

El miércoles, 28 de marzo de 2018, 21:20:30 (UTC+2), Justin du coeur escribió:

This isn't a Play problem per se, aside from the fact that Play by default pushes you to use the current Web standards.  The error is coming from the browser, telling you that you are violating security.

See this page for more information:

https://www.playframework.com/documentation/2.6.x/SecurityHeaders

You're going to need to set up an appropriate play.filters.headers.contentSecurityPolicy setting in your config file, telling it to allow inline styles (which are forbidden by default on the modern Web, on security grounds), or pull the CSS out to a separate file...

On Tue, Mar 27, 2018 at 9:59 AM, Sebastian Janas <janas.s...@gmail.com> wrote:

Hi,

I'm new in Play framework and start is already difficult :(

Can someone help me with the security issue?

Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-Px7/U7FvVB0gdAHejj6zZ5qhvm1sCBXmO7rJkx3iyhE='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

Basically, chrome and firefox don't display  CSS style.

I will be grateful for any help

Thanks
Sebastian
 

--
Please join our new forum at https://discuss.playframework.com!
The play-framework Google Group will soon be put into read-only mode.
For details, see https://blog.playframework.com/introducing-discuss-playframework-com/.
---
You received this message because you are subscribed to the Google Groups "Play Framework [deprecated]" group.

To unsubscribe from this group and stop receiving emails from it, send an email to play-framewor...@googlegroups.com.