Html 拒绝加载字体,因为它违反了以下内容安全策略指令:";默认src';无'&引用;

Html 拒绝加载字体,因为它违反了以下内容安全策略指令:";默认src';无'&引用;,html,express,Html,Express,我正在使用express,因为我有几个页面,并且它是托管的,所有其他页面都在服务器中加载,但当我单击一个页面(/newscegories/Bitcoin_news/1)时,它会显示出来 无法获取错误,在控制台中显示: 1:1拒绝加载字体“”,因为它违反了以下内容安全策略指令:“default src‘none’”。请注意,没有显式设置“font-src”,因此使用“default-src”作为回退 1:1拒绝加载映像“”,因为它违反了以下内容安全策略指令:“default src‘none’”。

我正在使用express,因为我有几个页面,并且它是托管的,所有其他页面都在服务器中加载,但当我单击一个页面(/newscegories/Bitcoin_news/1)时,它会显示出来

无法获取错误,在控制台中显示:

1:1拒绝加载字体“”,因为它违反了以下内容安全策略指令:“default src‘none’”。请注意,没有显式设置“font-src”,因此使用“default-src”作为回退

1:1拒绝加载映像“”,因为它违反了以下内容安全策略指令:“default src‘none’”。请注意,“img src”未显式设置,因此“default src”用作回退

在app.js中

app.engine('.html', require('ejs').__express);
app.use(express.static(__dirname + '/public'));

bodyParser = require('body-parser');
app.use(bodyParser.urlencoded({ extended: false }))
app.use(bodyParser.json())
app.set('view engine', 'html');
app.set('views', __dirname + '/views');
该页面的HTML代码

<!DOCTYPE html>
<html>
<head>
    <title>Crypto-News</title>
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-147461007-1"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());

  gtag('config', 'UA-147461007-1');
</script>
    <meta charset="UTF-8">
    <!-- <meta http-equiv="Content-Security-Policy" content="default-src *; style-src * 'unsafe-inline'; script-src * 'unsafe-inline' 'unsafe-eval'; img-src * data: 'unsafe-inline'; connect-src * 'unsafe-inline'; frame-src *;"> -->
    <!-- <meta http-equiv="content_security_policy": "default-src 'self' style-src 'self' 'unsafe-inline';" > -->
    <!-- <meta http-equiv="Content-Security-Policy" content="default-src 'self' https://fonts.googleapis.com https://beingevent.s3.ap-south-1.amazonaws.com https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css; connect-src * 'unsafe-inline';"> -->
    <!-- <meta http-equiv="Content-Security-Policy" content="default-src 'self'; font-src 'self'  https://fonts.googleapis.com;"> -->
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="mobile-web-app-capable" content="yes">
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <meta name="keywords" content="We do premier events to help connect like-minded entrepreneurs, industry insiders, investors." />
    <link href="https://fonts.googleapis.com/css?family=Montserrat|Open+Sans|Open+Sans+Condensed:300|Roboto&display=swap" rel="stylesheet">
    <link href="https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet">
    <link rel="stylesheet" type="text/css" href="/css/style.css">
    <link rel="stylesheet" href="/css/owl-1.css">
    <link rel="stylesheet" href="/css/owl-2.css">
    <link href="/css/bootstrap.css" rel="stylesheet">
    <link href="/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" type="text/css" href="/css/boot.css">
    <script type="text/javascript" src="/jss/qr/jquery.min.js"></script>
    <script type="text/javascript" src="/jss/qr/qrcode.js"></script>
    <script src="https://unpkg.com/sweetalert/dist/sweetalert.min.js"></script>
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-150412361-1"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.2.1/owl.carousel.min.js">
    <script src="/js/main.js"></script>
    <script src="/jss/jquery.js"></script>
 <script src="/jss/list-builder.js"></script>
 <script src="/jss/move/util.js"></script>
 <script src="/jss/move/main.js"></script>

加密新闻
window.dataLayer=window.dataLayer | |[];
函数gtag(){dataLayer.push(参数);}
gtag('js',新日期());
gtag(“配置”、“UA-147461007-1”);

在本地,它运行良好,没有错误,但在服务器上它没有运行显示错误,我找不到解决方案,请帮助我将
font.gstatic.com
添加到您的CSP?我需要添加到哪里?我有添加为元标记,但它显示相同的错误?