title: Jenkins Content Security Policy
body: <p>I'm confused about Jenkins Content Security Policy.</p>
  
  <p>I know these sites:</p>
  
  <ul>
  <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy" rel="noreferrer">Configuring Content Security Policy</a></li>
  <li><a href="http://content-security-policy.com/" rel="noreferrer">Content Security Policy Reference</a> </li>
  </ul>
  
  <p>I have a html page shown via Jenkins Clover Plugin. This html page uses inline style, e.g.:</p>
  
  <pre><code>&lt;div class='greenbar' style='width:58px'&gt;
  </code></pre>
  
  <p>The div-element visualizes a progressbar.
  Using the default Jenkins CSP configuration leads to the following result:
  <a href="http://i.stack.imgur.com/3Jr1h.png" rel="noreferrer">Progressbar_FAIL</a></p>
  
  <p>The result i want to have looks like this:
  <a href="http://i.stack.imgur.com/1cXuv.png" rel="noreferrer">Progressbar_WORKS</a></p>
  
  <p>I tried to relax the CSP rules, adding different combinations of parameters (script-src, style-src) with different levels (self, unsafe-inline,..) but nothing works.</p>
  
  <p>So my questions for now:</p>
  
  <ol>
  <li>Where do i have to specify the CSP configuration? </li>
  <li>Is it possible to use inline styles? </li>
  <li>Where should the styles be located? My css-stylesheets are located local on the Jenkins Server. </li>
  <li>What is the best way to get inline style and CSP rules "satisfied"</li>
  </ol>
  
  <p><strong>Update</strong> </p>
  
  <p><strong>1. Try:</strong>
  <code>-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'</code> 
  in the jenkins.xml file. Then the following error occurs:                </p>
  
  <blockquote>
    <p>Refused to apply inline style because it violates the following
    Content Security Policy directive: "default-src 'self'". Either the
    'unsafe-inline' keyword, a hash ('sha256-'), or a nonce
    ('nonce-...') is required to enable inline execution. Note also that
    'style-src' was not explicitly set, so 'default-src' is used as a
    fallback.</p>
  </blockquote>
  
  <p><strong>2. Try</strong>
  <code>-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'; style-src 'self'</code> in the jenkins.xml file. Then the following error occurs:   </p>
  
  <blockquote>
    <p>Refused to apply inline style because it violates the following
    Content Security Policy directive: "style-src 'self'". Either the
    'unsafe-inline' keyword, a hash
    ('sha256-'), or a nonce
    ('nonce-...') is required to enable inline execution</p>
  </blockquote>
  
  <p>I understand that this try can not solve my problem, because default-src includes style-src</p>
  
  <p><strong>3. Try</strong>
  <code>-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'; style-src 'unsafe-inline'</code> in the jenkins.xml file. Then the following error occurs: </p>
  
  <blockquote>
    <p>Refused to load the stylesheet
    s://jenkins/andsomedir/stylesheet.css [its https://... not allowed to post more than two links :(]
    because it violates the following Content Security Policy directive:
    "style-src 'unsafe-inline'".</p>
  </blockquote>