I’ve got a site configured with ENV like this: DISCOURSE_FORCE_HTTPS: true DISCOURSE_S3_ACCESS_KEY_ID: 'KEY' DISCOURSE_S3_SECRET_ACCESS_KEY: 'SECRET' DISCOURSE_BACKUP_LOCATION: 's3' DISCOURSE_ENABLE_S3_UPLOADS: true DISCOURSE_ENABLE_S3_INVENTORY: false DISCOURSE_S3_BACKUP_BUCKET: 'mybucket/backups' DISCOURSE_S3_UPLOAD_BUCKET: 'mybucket' DISCOURSE_S3_CDN_URL: 'https://mybuckets3.cdn.literatehosting.com' DISCOURSE_S3_REGION: 'us-west-1' DISCOURSE_BACKUP_WITH_UPLOADS: 'false' DISCOURSE_CDN_URL: 'https://mybucket.cdn.literatehosting.com' It worked fine until I added the s3 cdn url. After I added the S3 CDN, my browser started rejecting requests to the normal (not S3) CDN. I added the CDN url to SiteSetting.content_security_policy_script_src= and then it worked again. This seems like a bug, no? I just did a restart after changes these ENV variables, not a rebuild. Do I need to do a rake assets:precompile when I changed the CDN settings?

[image] riking: The CSP is supposed to whitelist the specific folders on the S3 and pull CDNs that scripts come from. I think I understand that. Is that CSP in the static assets that a rake assets:precompile makes? (But then why would adding it to the settings fix it.) [image] riking: What CSP was/is Discourse sending with the page? I’m afraid that I don’t quite know the canonical way to get the answer to that question. Not subfolder. A fairly standard install, though traefik is a reverse proxy in front of it.

[image] pfaffman: I’m afraid that I don’t quite know the canonical way to get the answer to that question. curl -I https://discourse.example.com/ or the Chrome inspector, and get the content of the Content-Security-Policy header.

CDN URL must be added to csp script src

Product Support Self-hosting

riking (Kane York) April 16, 2020, 5:58pm 2

Hmm, this should be working fine. The CSP is supposed to whitelist the specific folders on the S3 and pull CDNs that scripts come from.

What CSP was/is Discourse sending with the page? Is this a subfolder install?

Topic		Replies	Views
DISCOURSE_CDN_URL causes content security policy violations? Self-hosting cdn	4	1840	February 6, 2020
Admin upgrade page doesn't load with a CDN Product Support	3	1215	November 4, 2020
Assets not serving from CDN in latest update Product Support	16	2076	February 7, 2020
Defining DISCOURSE_S3_CDN_URL links to assets in S3 CDN URL Product Support	42	7670	April 22, 2020
Rake uploads:migrate_to_s3 fails because DISCOURSE_S3_CDN_URL env var is empty Self-hosting	1	789	September 27, 2019

CDN URL must be added to csp script src

Related topics