I am having trouble getting whitelisting by checksum to work in Firefox (52.0.2, windows). Despite Firefox supporting content security policy version 2 according to caniuse, the checksumming feature seems to not be accepted.
When Chrome blocks an inline script, it provides the necessary sha-256 code on the console. Adding this code to the CSP rules successfully whitelists the script. Interestingly, the checksum matches the one calculated at .
However, Firefox refuses to acknowledge it.
I have noticed that the example in the MDN docs uses base-16 encoding instead of base-64 for the checksum. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
Even when using the MDN example, I encounter the same issue. (Chrome also rejects with the base-16 encoding). I have tried various iterations similar to the following:
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<meta http-equiv="Content-Security-Policy"
content="script-src 'sha256-076c8f1ca6979ef156b510a121b69b6265011597557ca2971db5ad5a2743545f'">
<title>Hello CSP</title>
</head>
<body>
<script type="text/javascript">var inline = 1;</script>
</body>
</html>
Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src 'sha256-076c8f1ca6979ef156b510a121b69b6265011597557ca2971db5ad5a2743545f'”). Source: var inline = 1;.