title: Script causes “Refused to execute inline script: Either the 'unsafe-inline' keyword, a hash… or a nonce is required to enable inline execution”
body: <p>I keep getting this error:</p>
  
  <blockquote>
    <p>Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self' data: gap: <a href="http://www.visitsingapore.com" rel="noreferrer">http://www.visitsingapore.com</a> <a href="https://ssl.gstatic.com" rel="noreferrer">https://ssl.gstatic.com</a> 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-V+/U3qbjHKP0SaNQhMwYNm62gfWX4QHwPJ7We1PXokI='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.</p>
  </blockquote>
  
  <p>Can anyone tell me how to solve this and what does it mean?  My code is:</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' data:gap: http://www.visitsingapore.com   https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *"&gt;
  &lt;meta http-equiv="content-type" content="text/html; charset=UTF-8" /&gt;
  &lt;link rel="stylesheet" type="text/css" href="css/index.css"&gt;
  &lt;link rel="stylesheet" href="css/jquery.mobile-1.4.5.css"&gt;
  &lt;script src="lib/jquery-3.2.1.min.js"&gt;&lt;/script&gt;
  
  &lt;script type="text/javascript" src="scripts/key.js"&gt;&lt;/script&gt;
  &lt;script&gt;$.ajax({
          url: ' http://www.visitsingapore.com/api.listing.en.json',
          type: 'GET',
          beforeSend: function (xhr) {
              xhr.setRequestHeader('email ID', '-------@gmail.com');
              xhr.setRequestHeader('token ID', '-------');
          },
          data: {},
          success: function (qwe12) {
              var TrueResult2 = JSON.stringify(qwe12);
              document.write(TrueResult2);
          },
          error: function () { },
      });&lt;/script&gt;
  </code></pre>