Content Security Policy: What is a hash for href=javascript:<code>? - sha256

Question

I have an issue with Content Security Policy. Namely, given we have a web page with a link to a previous page:
Go back
what would be the correct base64-encoded sha256 value for this CSP-enabled web page (what to put instead of the question marks):
content-security-policy: default-src 'self';script-src 'self' 'sha256-?????????????????????'
Also, can you explain what original string was supposed to be hashed, for this link to work.
I tried hashing these strings and none of those worked:
javascript: history.back()
history.back()
history.back()
history.back();
The hashes for those are:
BF08EsGjXCEpB2NSaxWjxefwEeXHp/4SIfKJzR86L2w
XdsDF8eybIkQDjXcJT7sL9D/RQ2g7gopra+KI3RpfSI
LdlORHyUW/rwezK0l13nW+IwcZmi78eWOCBjewMWRr4
4LVO1Pw1wTlISwjHnezUwkDpDGQAU3rae9Klkjx5qCw
P.S. If you need a sha256 generator to create an answer, I was using this one, so it might help: https://approsto.com/sha-generator

Answer 1

Even though the hash is correct for that code it will probably still not work in many browsers. Rather extract the javascript to a separate js file and add an event listener on the element:
Go back
<script src="csptest.js"></script>
Then add a javascript file (csptest.js in my example). If you host it on the same server it will be accepted by the 'self' source in the script-src directive:
function goback(){
history.back();
}
document.getElementById("cspFriendly").addEventListener("click", goback);
Adding 'unsafe-inline' to script-src is an option, but is of course not desired.

Answer 2

MDN Says:
When generating the hash, don't include the <script> or <style> tags and note that capitalization and whitespace matter, including leading or trailing whitespace.... In CSP 2.0 this applied only to inline scripts. CSP 3.0 allows it in the case of script-src for external scripts.
Based on examples from that page, it appears the hash may only work for scripts found within <script> elements, and not those inlined with javascript:, onclick= and the like.