title: Content Security Policy: The page's settings blocked the loading of a resource at self?
body: <p>I have Java-based based web application running on <a href="http://en.wikipedia.org/wiki/Apache_Tomcat" rel="noreferrer">Tomcat</a> 6. My application is running on localhost and port 9001.</p>
  
  <p>To make my application more secure and to reduce the risk of <a href="http://en.wikipedia.org/wiki/Cross-site_scripting" rel="noreferrer">XSS</a> attacks, I added the header <code>Content-Security-Policy</code> with value <strong>default-src * 'unsafe-inline' 'unsafe-eval';script-src 'self'</strong>. With this I want to allow the web application to load the JavaScript files from same domain.</p>
  
  <p>For other resources it continues to load in the same fashion as it was without this header.</p>
  
  <p>But I am getting the below error.</p>
  
  <pre><code>Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src http://localhost:9001").
  </code></pre>