title: Refused to load the script 'https://www.google.com/recaptcha/api.js'
body: <p>I continue to get an error stating &quot;Refused to load the script 'https://www.google.com/recaptcha/api.js' because it violates the following Content Security Policy directive: &quot;script-src 'self' xxxxxxxxxxxxx&quot; Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.&quot;  I got the same error when disabling Chrome security via the command chrome.exe --user-data-dir=&quot;C:/Chrome dev session&quot; --disable-web-security.  I did see the google developer guide states to use nonce in reCAPTCHA api script tag.  I suspect a server has the policy.  How do I get the nonce value?  Why can I not disable Chrome security to test my code?  I am using an asp.net mvc website.  I have also tried a meta tag in the view unsuccessfully.</p>