title: Refused to load the script because it violates the following Content Security Policy directive
body: <p>When I tried to deploy my app onto devices with Android system above 5.0.0 (<a href="https://en.wikipedia.org/wiki/Android_Lollipop" rel="noreferrer">Lollipop</a>), I kept getting these kind of error messages:</p>
  <blockquote>
  <p>07-03 18:39:21.621: D/SystemWebChromeClient(9132):
  file:///android_asset/www/index.html: Line 0 : Refused to load the
  script 'http://xxxxx' because it violates the following Content
  Security Policy directive: &quot;script-src 'self' 'unsafe-eval'
  'unsafe-inline'&quot;. 07-03 18:39:21.621: I/chromium(9132):
  [INFO:CONSOLE(0)] &quot;Refused to load the script 'http://xxx' because it
  violates the following Content Security Policy directive: &quot;script-src
  'self' 'unsafe-eval' 'unsafe-inline'&quot;.</p>
  </blockquote>
  <p>However, if I deployed it to mobile device with Android system of 4.4.x (<a href="https://en.wikipedia.org/wiki/Android_version_history#Android_4.4_KitKat_.28API_level_19.29" rel="noreferrer">KitKat</a>), the security policy works with the default ones:</p>
  <pre><code>&lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot;default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *&quot;&gt;
  </code></pre>
  <p>Then I thought, maybe, I should change to something like this:</p>
  <pre><code>&lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot;script-src 'self' 'unsafe-eval' 'unsafe-inline'; object-src 'self'; style-src 'self' 'unsafe-inline'; media-src *&quot;&gt;
  </code></pre>
  <p>Basically, both options don't work for for me. How can I solve this issue?</p>