Question: I am creating a web app using the mean stack in angular 6 but I am getting below error message on the browser console.

> 
> "Refused to load the font '<URL>' because it violates the following
>  Content Security Policy directive: "default-src 'self'". Note that
>  'font-src' was not explicitly set, so 'default-src' is used as a
>  fallback."
> 
> 
> 

Code:

```
 getUsers() {
    return this._http.get("/api/users")
      .pipe(map(result => this.result = result.json().data));
  }

```

Answer: 
Content security policy is a way for modern browsers, to define a set of restrictions when loading remote resources.

Response headers from the HTTP protocol can set those policies: 

> 
> `Content-Security-Policy` header (official), `X-Content-Security-Policy` (supported by Mozilla Firefox and IE10) and `X-WebKit-CSP` (supported by Google Chrome and Safari) HTTP response headers with the list of Content Security Policy directives. *(from [seckit drupal module](https://www.drupal.org/project/seckit))*
> 
> 
> 

You can set different policies to different types of elements in the DOM (e.g `<img>`, `<script>`, `<object>`, `<embed>`, `<iframe>` and so on...), to restrict requests that originates from that element.

[![Screenshot of request with policy](https://i.stack.imgur.com/j6ctO.jpg)](https://i.stack.imgur.com/j6ctO.jpg)

So you need to change `'self'` to one of the following:

* `'none'` - block content from any source
* `'self'` - allow content only from your domain
* `'unsafe-inline'` - allow specific inline content (note, that it is supported by a subset of directives)
* `'unsafe-eval'` - allow a set of string-to-code API which is restricted by default (supported by script-src directive)

Wildcards (\*) are allowed:

* `*` - load content from any source
* `*.example.com` - load content from example.com and all its subdomains
* `example.com:*` - load content from example.com via any port. -
* Otherwise, it will use your website default port
just close all browser, clear cache and restart VSC or your code editor. Ir worked fro me.