Editing fields in Experience Editor not working

Question

For carousel components, when hovering over some text fields to edit, it does not show the cursor to edit. All other component fields are editable except for this carousel field.

Using Sitecore 10. This was working before.

It shows the following error in the console:

1, Refused to load the script 'a js script' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback in Ribbon.aspx?sc_content=core&ribbonId=""&itemId="" file

Answer 1

Content Security Policy (CSP) is a must-to-have HTTP response header for any website that helps to minimise XSS risks by declaring which dynamic resources are allowed to load.

Make sure that you have a Script-src directive for obtaining Javascript resources declared with all applicable source expressions in your config file in httpProtocol -> customHeaders section. More granular directives such as script-src-elem, script-src-attr etc. are also available, but for most cases the script-src definition should be enough.

For example:

script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com;

where:

• 'self' allows loading resources from the same origin - scheme, host and port;
• 'unsafe-inline' allows use of inline source elements such as style attribute, onclick, or script tag bodies;
• 'unsafe-eval' allows unsafe dynamic code evaluation such as JavaScript eval();
• https://example-domain.com allows loading resources from a certain domain name, from www.google-analytics.com in the above use case.

Full list of supported -src directives can be found here.