What's new

Welcome to the forum 👋, Visitor

To access the forum content and all our services, you must register or log in to the forum. Becoming a member of the forum is completely free.

Content-Security-Policy: where to place JavaScript

cadol_HTML

New member
Joined
Dec 2, 2025
Messages
1
Reaction score
0
HTML Coins
18
Hello everybody.

Here is a simple HTML file test1.html and a separate javascript file JS_test2.js which I want to be used in test1.html.
There are three buttons (INPUT TYPE="button") in test1.html. On pressing the button 1 the js function test1() should be called which is defined in the head section of the HTML file.
On pressing the button 2 the function test2() should be called which is defined in JS_test2.js.
And on pressing the button 3 the inline function should be called defined within the INPUT.



test1.html:


HTML:
<!DOCTYPE html>
<html>
  <head>
   <title>Test1</title>

   <meta http-equiv="Content-Security-Policy" content="script-src 'self'">

    <script language="JavaScript" src="JS_test2.js"> </script>
    
    <script type="text/javascript">
     <!-- Begin hiding contents from older browsers
  
     function test1()
      {
       alert("Test1");
      }

     //End hiding the contents -->
    </script>

  </head>


  <body>
    
    <br>
    
    <INPUT TYPE="button" name="sBtn1" id="sBtn1" value="Click me1" onClick="test1();">
    <br>
    <INPUT TYPE="button" name="sBtn2" id="sBtn2" value="Click me2" onClick="test2();">
    <br>
    <INPUT TYPE="button" name="sBtn3" id="sBtn3" value="Click me3" onClick="alert('test3 - inline, should be blocked');">

  </body>

</html>


JS_test2.js:

JavaScript:
<!-- Begin hiding contents from older browsers

function test2()
 {
  alert("Test2 in separate file");
 }

// End hiding the contents -->


For security reason a meta tag is placed in the head of the test1.html to restrict the javascript
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">

So far the present arrangement does not work. Not a single function can be evoked. In all three cases the console says:

Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src 'self'”

So my question is how to arrange the js code to be able to run it with if "script-src 'self'"? In the real app I need to place all my js functions in a separate file. I also tried to place the line

<script language="JavaScript" src="JS_test2.js"> </script>

inside the body tag. Is not working either...

Thank you in advance for your help
 

Theme customization system

You can customize some areas of the forum theme from this menu.

  • Wide/Narrow view

    You can control a structure that you can use to use your theme wide or narrow.

    Grid view forum list

    You can control the layout of the forum list in a grid or ordinary listing style structure.

    Picture grid mode

    You can control the structure where you can open/close images in the grid forum list.

    Close sidebar

    You can get rid of the crowded view in the forum by closing the sidebar.

    Fixed sidebar

    You can make it more useful and easier to access by pinning the sidebar.

    Close radius

    You can use the radius at the corners of the blocks according to your taste by closing/opening it.

  • Choose the color combination that reflects your taste
    Background images
    Color gradient backgrounds
Back