Warning/Error messages on sites with their own CSP

Ask for help about NoScript, no registration needed to post
elmex

Warning/Error messages on sites with their own CSP

Post by elmex »

Hello, i noticed console warnings/errors when i visit websites with their own CPS settings, that seem to come from noscript.

(My browser console output is in german, i tra to translate to.)

1. Content Security Policy: unknown directive 'report-to' could not be handled
(this occurs only if the site did not set "report-to" with its policy)

2. Content Security Policy: The settings of this page blocked to load a resource on self ("script-src 'script-src https://example.com'"). Source: call to eval() or related function blocked by CSP.
(in fact script-src is 'self', also happens with script-src: 'none')

Both you can reproduce by visiting sites that send CSP headers.

See Screenshot with example:

Image
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:58.0) Gecko/20100101 Firefox/58.0