I’ve got a site configured with ENV like this: DISCOURSE_FORCE_HTTPS: true DISCOURSE_S3_ACCESS_KEY_ID: 'KEY' DISCOURSE_S3_SECRET_ACCESS_KEY: 'SECRET' DISCOURSE_BACKUP_LOCATION: 's3' DISCOURSE_ENABLE_S3_UPLOADS: true DISCOURSE_ENABLE_S3_INVENTORY: false DISCOURSE_S3_BACKUP_BUCKET: 'mybucket/backups' DISCOURSE_S3_UPLOAD_BUCKET: 'mybucket' DISCOURSE_S3_CDN_URL: 'https://mybuckets3.cdn.literatehosting.com' DISCOURSE_S3_REGION: 'us-west-1' DISCOURSE_BACKUP_WITH_UPLOADS: 'false' DISCOURSE_CDN_URL: 'https://mybucket.cdn.literatehosting.com' It worked fine until I added the s3 cdn url. After I added the S3 CDN, my browser started rejecting requests to the normal (not S3) CDN. I added the CDN url to SiteSetting.content_security_policy_script_src= and then it worked again. This seems like a bug, no? I just did a restart after changes these ENV variables, not a rebuild. Do I need to do a rake assets:precompile when I changed the CDN settings?

Hmm, this should be working fine. The CSP is supposed to whitelist the specific folders on the S3 and pull CDNs that scripts come from. What CSP was/is Discourse sending with the page? Is this a subfolder install?

[image] riking: The CSP is supposed to whitelist the specific folders on the S3 and pull CDNs that scripts come from. I think I understand that. Is that CSP in the static assets that a rake assets:precompile makes? (But then why would adding it to the settings fix it.) [image] riking: What CSP was/is Discourse sending with the page? I’m afraid that I don’t quite know the canonical way to get the answer to that question. Not subfolder. A fairly standard install, though traefik is a reverse proxy in front of it.

[image] pfaffman: I’m afraid that I don’t quite know the canonical way to get the answer to that question. curl -I https://discourse.example.com/ or the Chrome inspector, and get the content of the Content-Security-Policy header.

CDN URL must be added to csp script src

Product Support Self-hosting

riking (Kane York) April 16, 2020, 6:41pm 4

curl -I https://discourse.example.com/ or the Chrome inspector, and get the content of the Content-Security-Policy header.

Topic		Replies	Views
DISCOURSE_CDN_URL causes content security policy violations? Self-hosting cdn	4	1840	February 6, 2020
Admin upgrade page doesn't load with a CDN Product Support	3	1215	November 4, 2020
Assets not serving from CDN in latest update Product Support	16	2076	February 7, 2020
Defining DISCOURSE_S3_CDN_URL links to assets in S3 CDN URL Product Support	42	7670	April 22, 2020
Rake uploads:migrate_to_s3 fails because DISCOURSE_S3_CDN_URL env var is empty Self-hosting	1	789	September 27, 2019

CDN URL must be added to csp script src

Related topics