Content-Security-Policy incompatibilities about ifm

[j75]

'self' already existed - but data: has solved my problems !

Thanks again!

[misterunknown]

You have two options:

• use the CDN version of the IFM
• adjust your CSP header

For the latter I guess you have to add unsafe-inline to font-src.

[j75]

Sorry, it doesn't work with unsafe-inline :

Refused to load the font 'data:application/octet-stream;base64,d09GRgABAAAAAEEYAA8AAAAAeBQAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABWAAAADsAAABUIIslek9TLzIAAAGUAAAAQwAAAFY+L1L9Y21hcAAAAdgAAAJPAAAF5oRYnGZjdnQgAAAEKAAAABMAAAAgBtX+5mZwZ20AAAQ8AAAFkAAAC3CKkZBZZ2FzcAAACcwAAAAIAAAACAAAABBnbHlmAAAJ1AAAMd0AAFv8cFA8X2hlYWQAADu0AAAAMwAAADYPx60EaGhlYQAAO+gAAAAgAAAAJAd1A9ZobXR4AAA8CAAAAHMAAAEc9cH/zWxvY2EAADx8AAAAkAAAAJDjAPw+bWF4cAAAPQwAAAAgAAAAIAG+DbBuYW1lAAA9LAAAAXcAAALNzJ0dH3Bvc3QAAD6kAAAB9QAAA29YoVQHcHJlcAAAQJwAAAB6AAAAhuVBK7x4nGNgZGBg4GIwYL...TzvOC6Z+7wkIvyKC20ppVmoorVz6aQVEVczEWjwzkXhzRS1JIOVc2qHRd3XdxzcT/hrDrK6bHuG3mqr4TUqQ25JRA71NTjTm5ectGQzIv2ibGizLVZ4DV5CiQpqjmnZnTggV2QrR1xNkw37PGVRFNpPCj42on1puk/mZU+9j53paxTYHuxZcOqVdaxcomTURVLS2j8N7Gkhi41k6Y1+oNtZ/1hszw0NJt6spna/mRTr51KuNHaFHOazJiRXJNZ6kArJBk4RI9Lyrd9V7RU1oJV2rfY0gxmDq7fmK8XDWHCwxUjVPiVpSA0VtwUpArVwjAYudjRCd2DC4LfY14JmgAAAHicY/DewXAiKGIjI2Nf5AbGnRwMHAzJBRsZWJ02MTAyaIEYm7mYGDkgLD4GMIvNaRfTAaA0J5DN7rSLwQHCZmZw2ajC2BEYscGhI2Ijc4rLRjUQbxdHAwMji0NHckgESEkkEGzmYWLk0drB+L91A0vvRiYGFwAMdiP0AAA=' because it violates the following Content Security Policy directive: "font-src 'self' 'unsafe-inline'".

[j75]

And the cdn version also has its issues:

Refused to load the script '<URL>' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' ". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

cdn.ifm.php:430 Uncaught ReferenceError: jQuery is not defined
    at cdn.ifm.php:430

[misterunknown]

Hm, yeah, obviously the CDN version does not work because the relevant URLs are not present within the CSP header.

I'm not sure why the adjustment of font-src in the CSP header (adding unsafe-inline) does not work. Maybe you have to add 'self' instead of 'unsafe-inline'.

This comment suggests that you can add the data: scheme, so fonts can be loaded.