title: ContentSecurityPolicyViolation
body: <p>I'm trying to implement a basic chat application with Lift 3 and lift-ng (Angular). Mostly, this is working. However, I am getting this warning in my (server side) log: </p>
  
  <blockquote>
    <p>[qtp1721931908-24] WARN
    net.liftweb.http.ContentSecurityPolicyViolation - Got a content
    security violation report we couldn't interpret:
    'Full({"csp-report":{"document-uri":"<a href="http://localhost:8081/" rel="nofollow">http://localhost:8081/</a>","referrer":"","violated-directive":"script-src
    'unsafe-eval'
    'self'","effective-directive":"script-src","original-policy":"default-src
    'self'; img-src *; script-src 'unsafe-eval' 'self'; style-src 'self'
    'unsafe-inline'; report-uri
    /lift/content-security-policy-report","blocked-uri":"inline","status-code":200}})'.</p>
  </blockquote>
  
  <p>What I want to know is <em>how to track down what is causing that violation</em>? I am pretty unclear what part of the code or binding might be surfacing that, or how to narrow it down without having to painstakingly comment out every single part of the codebase.</p>
  
  <p>I can easily get rid of the violation by setting up this <code>SecurityRule</code> in my <code>Boot.scala</code>:</p>
  
  <pre><code>LiftRules.securityRules = () =&gt; {
    SecurityRules(content = Some(ContentSecurityPolicy(
      scriptSources = List(ContentSourceRestriction.Self,
        ContentSourceRestriction.UnsafeInline,
        ContentSourceRestriction.UnsafeEval)
    )))
  }
  </code></pre>
  
  <p>However, I'd like to avoid using the unsafe inlining/eval. </p>