we was updated Discourse @ 2021-04-08. Then we noticed the content_security_policy may have some issue. GTM for content security policy script src [2021-04-10_11-25-49] F12 for console: [2021-04-10_11-26-52] This happened updated to newest version of discourse.

Can you show us the full CSP header as sent?

@supermathie Thank you very much for your quick response. I tried to load header from Firefox, I am not sure did I do something right. Please see attachment of the screen. [2021-04-10_13-15-48] Changed to Chrome. In here, maybe you can have more detail for the request. [2021-04-10_13-32-02]

Things must have changed since the original post since it’s now behaving as it should: ○ → curl -I https://www.ossez.com HTTP/2 200 … content-security-policy: base-uri 'none'; object-src 'none'; script-src https://www.ossez.com/logs/ https://www.ossez.com/sidekiq/ https://www.ossez.com/mini-profiler-resources/ https://www.ossez.com/assets/ https://www.ossez.com/brotli_asset/ https://www.ossez.com/extra-locales/ https://www.ossez.com/highlight-js/ https://www.ossez.com/javascripts/ https://www.ossez.com/plugins/ https://www.ossez.com/theme-javascripts/ https://www.ossez.com/svg-sprite/ https://www.googletagmanager.com/gtm.js 'nonce-38d2a45e5e933b869e14465772b2c0de' https: https://tagmanager.google.com https://www.googletagmanager.com 'unsafe-inline' https://analytics.ossez.com/matomo.js https://www.ossez.com/cdn-cgi/apps/head/qk5vBDFy7qBIoPy3q8a6LUoKei8.js https://www.googletagmanager.com/gtm.js; worker-src 'self' https://www.ossez.com/assets/ https://www.ossez.com/brotli_asset/ https://www.ossez.com/javascripts/ https://www.ossez.com/plugins/ ‘unsafe-inline’ is now properly quoted, but is being ignored by Chrome: Refused to execute inline script because it violates the following Content Security Policy directive: […] Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list. and Firefox: Content Security Policy: Ignoring “‘unsafe-inline’” within script-src or style-src: nonce-source or hash-source specified since you’ve specified a nonce value in the CSP list: 'nonce-38d2a45e5e933b869e14465772b2c0de' I see that you’re behind Cloudflare; please note that you have to disable various Cloudflare features since by default they will break Discourse.

לאחר שדרוג, ה-script src של ה-Content Security Policy עבור GTM

קהילה נתונים ודיווח

honeymoose (HoneyMoose) 13 באפריל,‏ 2021,‏ 3:26pm 5

Thank you very much.

נושא		תגובות	צפיות
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25942	13 ביוני,‏ 2023
Add CSP nonce-source support Development	11	4287	2 בנובמבר,‏ 2018
How to fix problem with CSP Product Support	8	6921	9 במרץ,‏ 2022
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	304	1 ביולי,‏ 2025
Theme component invalid “extend content security policy” value Bug	3	225	11 בפברואר,‏ 2025

לאחר שדרוג, ה-script src של ה-Content Security Policy עבור GTM

נושאים קשורים