CSP 限制，但未在 HTML 或 HTTP 标头中指定

Question

I get Content Security Policy errors such as:

Firefox: Content Security Policy: The page's settings blocked...

Chrome: ... violates the following Content Security Policy directive...

But I don't have any <meta http-equiv="Content-Security-Policy"...> in the HTML, nor any Content-Security-Policy headers in the HTTP responses. Where else could it be set and/or how do I debug this with the browser's dev tools?

Answer 1

It can also be caused by browser extensions that can add Content Security Policies to your page, especially advertisement and content blockers. In my case it was caused by specific configurations of uMatrix which I had been using for testing.