Question: I am creating a web app using the mean stack in angular 6 but I am getting below error message on the browser console.

> 
> "Refused to load the font '<URL>' because it violates the following
>  Content Security Policy directive: "default-src 'self'". Note that
>  'font-src' was not explicitly set, so 'default-src' is used as a
>  fallback."
> 
> 
> 

Code:

```
 getUsers() {
    return this._http.get("/api/users")
      .pipe(map(result => this.result = result.json().data));
  }

```

Answer: 
Adding 'self' and data: to the font-src works for me.

```
Content-Security-Policy: font-src 'self' data:;

```
> 
> [font-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src) reference doc from MDN
> 
> 
> 

The Content-Security-Policy header is set by your api. Check your api response for its value.
As per the error, I think your fonts are loaded from a different domain than your application domain. Unless your api whitelists that domain, your browser will not load the font.

Example:

```
Content-Security-Policy: font-src https://example.com/

```