For carousel components, when hovering over some text fields to edit, it does not show the cursor to edit. All other component fields are editable except for this carousel field.

Using Sitecore 10. This was working before.

It shows the following error in the console:

1, Refused to load the script 'a js script' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback in Ribbon.aspx?sc_content=core&ribbonId=""&itemId="" file

  • Check your CSP headers. Your error is saying a script was blocked because of a CSP header so that is your issue.
    – Gatogordo
    Jan 3, 2022 at 10:08
  • But in components other than carousel, editing is possible. there also this console error is showing.
    – Aswathy
    Jan 3, 2022 at 10:27

1 Answer 1


Content Security Policy (CSP) is a must-to-have HTTP response header for any website that helps to minimise XSS risks by declaring which dynamic resources are allowed to load.

Make sure that you have a Script-src directive for obtaining Javascript resources declared with all applicable source expressions in your config file in httpProtocol -> customHeaders section. More granular directives such as script-src-elem, script-src-attr etc. are also available, but for most cases the script-src definition should be enough.

For example:

script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com;


  • 'self' allows loading resources from the same origin - scheme, host and port;
  • 'unsafe-inline' allows use of inline source elements such as style attribute, onclick, or script tag bodies;
  • 'unsafe-eval' allows unsafe dynamic code evaluation such as JavaScript eval();
  • https://example-domain.com allows loading resources from a certain domain name, from www.google-analytics.com in the above use case.

Full list of supported -src directives can be found here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.