title: Sha hash not respected in CSP style-src
body: <p>I have an ASP.NET web application that makes use of <code>asp-validation-summary</code>. Because of this an inline <code>style</code> is added to an HTML element in my page.</p>
  
  <p>This gives me the following error in console (Chrome v78.0.3904.108) when I run my application:</p>
  
  <blockquote>
    <p>Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' <a href="https://fonts.googleapis.com" rel="noreferrer">https://fonts.googleapis.com</a>". Either the 'unsafe-inline' keyword, a hash ('sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE='), or a nonce ('nonce-...') is required to enable inline execution.</p>
  </blockquote>
  
  <p>So I added the hash to my CSP, which now looks like this:</p>
  
  <pre><code>style-src 'self' https://fonts.googleapis.com 'sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE=';
  </code></pre>
  
  <p>When I load my page I still get a similar error:</p>
  
  <blockquote>
    <p>Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' <a href="https://fonts.googleapis.com" rel="noreferrer">https://fonts.googleapis.com</a> 'sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE='". Either the 'unsafe-inline' keyword, a hash ('sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE='), or a nonce ('nonce-...') is required to enable inline execution.</p>
  </blockquote>
  
  <p>This is the entire CSP header:</p>
  
  <pre><code>X-Content-Security-Policy: default-src 'self'; object-src 'none'; frame-ancestors 'none'; sandbox allow-forms allow-same-origin allow-scripts; base-uri 'self'; upgrade-insecure-requests; style-src 'self' https://fonts.googleapis.com 'sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE='; font-src 'self' https://fonts.gstatic.com;
  </code></pre>
  
  <p>As you can see I've added the hash, as sugested in the error. It also seems to be a <a href="https://cspvalidator.org/#headerValue%5B%5D=default-src+&#39;self&#39;%3B+object-src+&#39;none&#39;%3B+frame-ancestors+&#39;none&#39;%3B+sandbox+allow-forms+allow-same-origin+allow-scripts%3B+base-uri+&#39;self&#39;%3B+upgrade-insecure-requests%3B+style-src+&#39;self&#39;+https%3A%2F%2Ffonts.googleapis.com+&#39;sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE%3D&#39;%3B+font-src+&#39;self&#39;+https%3A%2F%2Ffonts.gstatic.com%3B&amp;strategy=intersection" rel="noreferrer">valid header</a>.</p>
  
  <p>But why isn't this working?</p>