title: Why doesn't Chrome respect my Content Security Policy hashes?
body: <p>I'm having to add CSP to a page that has inline styles, and to avoid using <code>unsafe-inline</code> I'm using hashes. My technique for adding the hashes is just to load the page in Chrome, see the error messages and copy all the suggested hashes (eg take <code>&lt;suggested hash&gt;</code> from <code>Refused to apply inline style because it violates the following Content Security Policy directive: "style-src ...". Either the 'unsafe-inline' keyword, a hash ('&lt;suggested hash&gt;'), or... is required to enable inline execution.</code>).</p>
  
  <p>This fixed the problem in Firefox, but not in Chrome. Oddly enough, Chrome doesn't appear to respect the hashes that it itself has generated. This leads to a funny situation whereby Chrome lists the policy including the hash, says it doesn't comply, and then recommends that I add a hash that was in the policy it printed just before.</p>
  
  <p>My policy: </p>
  
  <p><code>default-src 'none'; font-src 'self' data:; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self' 'sha256-/3kWSXHts8LrwfemLzY9W0tOv5I4eLIhrf0pT8cU0WI=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-OTeu7NEHDo6qutIWo0F2TmYrDhsKWCzrUgGoxxHGJ8o=' 'sha256-fviu5RwuBYFcCd5CDanhy6NCLufcwvCAbm061aSqhoQ=' 'sha256-wS7xf+bhXBr5EM064hQkAW0vX3ks5VoxbGn+KQC/Vhk=' 'sha256-cxL35Ug49Sl1zHMOdz/r0xinQ6BYGgClHdDCk2XPTzE='; object-src 'self'; connect-src 'self'</code></p>
  
  <p>This results in numerous errors such as:</p>
  
  <p><code>Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'sha256-/3kWSXHts8LrwfemLzY9W0tOv5I4eLIhrf0pT8cU0WI=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-OTeu7NEHDo6qutIWo0F2TmYrDhsKWCzrUgGoxxHGJ8o=' 'sha256-fviu5RwuBYFcCd5CDanhy6NCLufcwvCAbm061aSqhoQ=' 'sha256-wS7xf+bhXBr5EM064hQkAW0vX3ks5VoxbGn+KQC/Vhk=' 'sha256-cxL35Ug49Sl1zHMOdz/r0xinQ6BYGgClHdDCk2XPTzE='". Either the 'unsafe-inline' keyword, a hash ('sha256-/3kWSXHts8LrwfemLzY9W0tOv5I4eLIhrf0pT8cU0WI='), or a nonce ('nonce-...') is required to enable inline execution.</code> wherein Chrome recommends that I add a hash that is already present in the policy.</p>
  
  <p>Probably there's some Chrome-specific gotcha I'm missing. Any ideas what it might be?</p>