Hello! I’m have problem with CSP, how to fix this? [screen] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src https://mydomain.com/logs/ https://mydomain.com/sidekiq/ https://mydomain.com/mini-profiler-resources/ https://mydomain.com/assets/ https://mydomain.com/brotli_asset/ https://mydomain.com/extra-locales/ https://mydomain.com/highlight-js/ https://mydomain.com/javascripts/ https://mydomain.com/plugins/ https://mydomain.com/theme-javascripts/ https://mydomain.com/svg-sprite/ https://mydomain.com". Either the 'unsafe-inline' keyword, a hash ('sha256-ScCk7JwXKy22dTO0VFM7aV1chV+yd/MUda4X6VnGans='), or a nonce ('nonce-...') is required to enable inline execution. For the test, I went into a safe mode, in safe mode there is the same problem.

It’s not my forte, but I’ve had a search and you may need to rewrite the inline script you’re trying to use: [image]Refuse to reload script (CORS) with my settings That error means you are trying to run a script inline, which is disallowed by your current CSP configuration. You have two options: Fix the script that is trying to execute the inline. (recommended) Disable CSP (not recommended)

I don’t want to disable CSP protection and I don’t have external scripts, I tried to disable all the plugins and the components of the topic, it didn’t help. I try add all this link to content security policy script src in the admin setting, problem was safe :frowning: https://mydomain.com/logs/ https://mydomain.com/sidekiq/ https://mydomain.com/mini-profiler-resources/ https://mydomain.com/assets/ https://mydomain.com/brotli_asset/ https://mydomain.com/extra-locales/ https://mydomain.com/highlight-js/ https://mydomain.com/javascripts/ https://mydomain.com/plugins/ https://mydomain.com/theme-javascripts/ https://mydomain.com/svg-sprite/ https://mydomain.com`

You need to share your site URL for we to be able to help you.

Hm… It seems I found the reason, it seems that the problem occurs because I use the meta tag CSP in my theme: I need to use the img-src directive to limit the display of images from prohibited hosts.

How I can change the default CSP directives in header, to added img-src without use meta tag? I’m try this in Rails, but nothing change: Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://mydomain.com/logs/ https://mydomain.com/sidekiq/ https://mydomain.com/mini-profiler-resources/ https://mydomain.com/assets/ https://mydomain.com/brotli_asset/ https://mydomain.com/extra-locales/ https://mydomain.com/highlight-js/ https://mydomain.com/javascripts/ https://mydomain.com/plugins/ https://mydomain.com/theme-javascripts/ https://mydomain.com/svg-sprite/; worker-src 'self' https://mydomain.com/assets/ https://mydomain.com/brotli_asset/ https://mydomain.com/javascripts/ https://mydomain.com/plugins/; frame-ancestors 'self'; manifest-src 'self'; img-src data: https://mydomain.com https://imgur.com"})

I’m delete this meta tag, bebuild and problem was safe :frowning:

How to fix problem with CSP

Product Support

Falco (Falco) March 9, 2022, 6:36pm 7

Oh that CSP directive will indeed break Discourse completely.

Topic		Replies	Views
Refuse to reload script (CORS) with my settings Product Support	1	1185	January 31, 2021
After upgrade the content security policy script src for GTM Data & reporting	4	1995	April 13, 2021
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	303	July 1, 2025
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25917	June 13, 2023
Add CSP nonce-source support Development	11	4285	November 2, 2018

How to fix problem with CSP

Related topics