We’re currently trying to integrate the payment provider Steady – Du machst Medien. Wir den Rest. into our discourse site. Unfortunately, I don’t get their javascript code past our content security policy. I whitelisted every domain I could find in the code, but still get this in the developer conso…

I think the script you’re trying to integrate uses eval() which is blocked by default (the reason is explained in the link above) so you need to add 'unsafe-eval' to your CSP setting if you want that to work.

[image] RGJ: Why do you think this is a CSP error? Everything works as expected, when I deactivate the content security policy, so this was the best guess I could come up with. :wink: Thanks for the hint! Do you have a tip on how to solve this?

Need help with the content security policy

Product Support

RGJ (Richard - Communiteq) May 15, 2020, 4:16pm 2

Why do you think this is a CSP error?

(If it was, the code wouldn’t even run, and it is, because it throws an error).

Topic		Replies	Views
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25747	June 13, 2023
After upgrade the content security policy script src for GTM Data & reporting	4	1986	April 13, 2021
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	286	July 1, 2025
Cannot add content security policy script src Product Support	2	201	January 1, 2025
When install html script facing issue? Product Support	8	1724	April 25, 2020

Need help with the content security policy

Related topics