---
title: "Allow Everything in Page Content Security Policy"
date: 2022-12-30T15:14:19.000Z
author: Z.SHINCHVEN
tags: [Content-Security-Policy, security]
canonical: https://atlassc.net/2022/12/31/allow-everything-in-page-content-security-policy
---
Content got blocked by Content-Security-Policy? No problem, just allow everything.

And of course, this is really a bad practice.

```html
<meta http-equiv="Content-Security-Policy" content="default-src * self blob: data: gap:; style-src * self 'unsafe-inline' blob: data: gap:; script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:; object-src * 'self' blob: data: gap:; img-src * self 'unsafe-inline' blob: data: gap:; connect-src self * 'unsafe-inline' blob: data: gap:; frame-src * self blob: data: gap:;">
```

Reference: 

- [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
- [Answer to Refused to load the script because it violates the following Content Security Policy directive](https://stackoverflow.com/a/59531227/2108080)