title: Content Security Policy hash not recognized by Safari 11.0.3
body: <p>I have a meta tag with the following directive inside of it:</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="base-uri 'self'; script-src 'self' 'sha256-s5EeESrvuQPpk2bpz5I3zn/R8Au2DYB1Z+YUH9p0fUE=' 'sha256-PYYfGnkbZ44B9ZBpgv8NbP3MXT560LMfrDSas2BveJo=';"&gt;
  </code></pre>
  
  <p>I then have 2 inline scripts further down the page, each which should match one of the generated shas in the policy.</p>
  
  <p>In Chrome and Firefox, I get no complaints and my scripts run as expected.</p>
  
  <p>In Safari Version 11.0.3 (13604.5.6), I get the following error:</p>
  
  <pre><code>Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy
  </code></pre>
  
  <p>and I am confused as to why!</p>
  
  <p>Unfortunately, I am unable to produce a minimum reproducible repo with the issue inside of it - smaller examples work in Safari for me, so it leads me to believe it's to do with something specific in my app, possibly related to the second thing I have tried below.</p>
  
  <p>Any help would be much appreciated!</p>
  
  <h2>Things I have tried:</h2>
  
  <p><strong>Are hashes supported?</strong></p>
  
  <p>According to <a href="https://stackoverflow.com/questions/44318505/safari-content-security-policy-support">this Stack Overflow post</a> and the <a href="https://developer.apple.com/library/content/releasenotes/General/WhatsNewInSafari/Introduction/Introduction.html" rel="noreferrer">Safari release notes</a>, CSP 2.0 which supports hashes was implemented in Safari 10</p>
  
  <p><strong>Correct charset?</strong></p>
  
  <p>Previously, I was seeing issues because I was calculating the hashes based on a UTF-8 charset, but was outputting the JS to the browser without a charset meta tag in place. Special characters in my JS were being mangled and were causing differences in the shas when the browser tried calculating them.</p>
  
  <p>I don't believe this is affecting me now since Chrome and Firefox see no issues, but maybe I'm wrong here?</p>
  
  <p><strong><code>unsafe-inline</code> for Safari, and then allow hashes to override that in Chrome and Firefox?</strong></p>
  
  <p>According to the CSP spec, <code>unsafe-inline</code> is <a href="https://www.w3.org/TR/CSP2/#directive-script-src" rel="noreferrer">ignored if a hash or nonce is present</a>. Safari 11 also adheres to this, so adding the <code>unsafe-inline</code> keyword has no effect</p>