Demo: Firefox CSP hash-source / nonce-source bug


I don't know ...


This page contains two stylesheets, but there is a Content Security Policy in place, that allows only the first one to load. That is, if your browser fully supports CSP 1.1 or above: If 'unsafe-inline' is not in the list of allowed style sources, or if at least one nonce-source or hash-source is present in the list of allowed style sources: whenever the user agent would apply style from a style element that lacks a valid nonce and lacks a valid hash for the allowed style sources, instead the user agent MUST ignore the style, and MUST report a violation. Otherwise, you'll see an ugly red error message (which is injected by the second stylesheet) at the top of this page.