用于cordova应用程序的facebook登录

debugcn 发表于 Dev

莎兰·阿纳普拉普拉（Sharan Ainapurapu）

我正在尝试将Facebook登录与Cordova应用集成。我收到以下错误。我使用了https://github.com/Wizcorp/phonegap-facebook-plugin。

我实际上遵循了此链接Cordova-拒绝执行内联事件处理程序，因为它违反了以下内容安全策略，无法解决此问题。

错误：

cordova oauth拒绝执行内联脚本，因为它违反了以下内容安全策略指令：default-src self data：间隙：https : //ssl.gstatic.com unsafe-eval。要启用内联执行，需要使用unsafe-inline关键字，哈希（sha256-HNED5JYugsSN2fW8J37cauBfrz4h1d04l7WiLk8vriA =）或随机数（nonce -...）。另请注意，未明确设置script-src，因此将default-src用作后备`
未捕获的TypeError：无法读取null的属性'querySelector'

这是代码

Index.js

var app = {
initialize: function() {
    this.bindEvents();
},

bindEvents: function() {
    document.addEventListener('deviceready', this.onDeviceReady, false);
},

onDeviceReady: function() {
    app.receivedEvent('deviceready');
},
receivedEvent: function(id) {
    var parentElement = document.getElementById(id);
    var listeningElement = parentElement.querySelector('.listening');
    var receivedElement = parentElement.querySelector('.received');
    listeningElement.setAttribute('style', 'display:none;');
    receivedElement.setAttribute('style', 'display:block;');
    if (window.cordova.platformId == "browser") {
        facebookConnectPlugin.browserInit("xxxxxxxxxxxxxxxxx");
      }
    console.log('Received Event: ' + id);
}
};

还有其他人遇到过同样的问题吗？有人有示例工作项目吗？

瑞奇

您需要在中设置Content-Security-Policy<meta>标签index.html。

请参阅cordova-plugin-whitelist docs：

<!-- Good default declaration:
    * gap: is required only on iOS (when using UIWebView) and is needed for JS->native communication
    * https://ssl.gstatic.com is required only on Android and is needed for TalkBack to function properly
    * Disables use of eval() and inline scripts in order to mitigate risk of XSS vulnerabilities. To change this:
        * Enable inline JS: add 'unsafe-inline' to default-src
        * Enable eval(): add 'unsafe-eval' to default-src
-->
<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com; style-src 'self' 'unsafe-inline'; media-src *">

<!-- Allow requests to foo.com -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self' foo.com">

<!-- Enable all requests, inline styles, and eval() -->
<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'">

<!-- Allow XHRs via https only -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self' https:">

<!-- Allow iframe to https://cordova.apache.org/ -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; frame-src 'self' https://cordova.apache.org">

本文收集自互联网，转载请注明来源。

如有侵权，请联系[email protected] 删除。