Error about inline Javascript

[carlsonp]

See web developer window...

Chrome:

Refused to execute inline script because it violates the...

Firefox:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

Tree test and card sort broken, didn't try others. It looks like this inline Javascript needs to be moved into their own files?

[carlsonp]

Turns out it's content security policy (CSP) which is part of the NPM Helmet package.

https://github.com/helmetjs/helmet/tree/main/middlewares/content-security-policy

It can be turned off via:

app.use(helmet({contentSecurityPolicy: false}));

But I don't think that's the correct solution.

[carlsonp]

Looks like any inline <script></script> Javascript needs to go.