Content Security Policy with script-src 'self' prevents Application Insights javascript running #1443
Description
In Shared/_Layout I have added the following line within the <head> section of my application:
@Html.Raw(JavaScriptSnippet.FullScript)
Which correctly outputs the Application Insights javascript, inline. However, my application has the following header in the response for security reasons...
Content-Security-Policy:script-src 'self';
... which prevents inline javascript. Therefore, I receive the following error in the browser console (chrome):
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-od4GZDd/FJpzTaUjnBJEZbKvWwfP3SPsG+UsfNdoDpc='), or a nonce ('nonce-...') is required to enable inline execution.