Post History

Why does Firefox block based on a restrictive default-src directive, when more specific, more permissive *-src exist?

I am working on a website which unfortunately uses a mix of linked and inline CSS and Javascript (and, even more unfortunately, I can't do a lot about the use of inline CSS and Javascript), and am trying to set up an appropriate [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) for it.

When I serve the content (over proper HTTPS with a CA-signed certificate) with a CSP that doesn't include any [default-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src) directive, things work as I expect. For example, if the HTTP response contains the headers

    Content-Security-Policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/;
    Content-Security-Policy: font-src 'self' https://fonts.gstatic.com/;

then Google-hosted fonts are loaded; if I remove the `https://fonts.gstatic.com/` entry from `font-src` but leave the `font-src` directive itself in place, then the browser reports that they were blocked based on `font-src`. This is exactly what I expect to happen.

However, if I also add

    Content-Security-Policy: default-src 'self';

then I get a whole bunch of errors, including ones where the reference points at the beginning of an inline `<style>` element, *even though* I'm still serving the same `style-src` policy as above including the `'unsafe-inline'`.

MDN says that (my emphasis):

> The HTTP Content-Security-Policy (CSP) default-src directive **serves as a fallback** for the other CSP fetch directives. For each of the following directives **that are absent**, the user agent looks for the default-src directive and uses this value for it:

`style-src` is one of the directives thus listed, and `'self'` is one of the valid values for `default-src`.

I would expect the more specific (and in this case, more permissive) `style-src` to take precedence over the more restrictive, fallback `default-src`, but that doesn't seem to be happening. Rather, it seems that the `default-src` directive is being used *instead of* (or possibly as further restricting) the more specific `style-src` directive.

I have also tried to serve everything as a single, long `Content-Security-Policy` response header, but that doesn't seem to change anything for me.

What am I missing? Is the CSP `default-src` directive useless for my use case, and I need to list all CSP directives explicitly to get the effect I am after, namely providing a highly restrictive policy for everything that doesn't actually need to be more permissive?