inline js script tag isn’t being loaded due to csp and idk how to fix it.
AI-generated summary
TheNab is encountering issues with a script tag not loading in a landing pages plugin due to the content-security-policy (CSP). awesomerobot provided a link to a Discourse meta post detailing CSP and third-party integrations, suggesting checking browser console for script sources and adding them to the content_security_policy_script_src setting. TheNab stated they’ve reviewed related posts but struggles to implement the exception. awesomerobot asked about browser console errors and provided an example image of a CSP error related to inline script execution, suggesting adding the sha256-xxxxx hash to the site setting. TheNab reported receiving a nonce-s0m3h4sh error in Firefox, but a sha256-s0m3h4sh error in Chrome, implying the hash value differs by browser.
There’s some information in this post that may help: Mitigate XSS Attacks with Content Security Policy
I’ve read through that and others but cannot piece together how to actually add the exception to the content_security_policy_script_src
Do you see an error concerning the script in your browser console? something like this?
You’ll want to add that provided hash ('sha256-xxxxx') to the “content security policy script src” setting found in admin > all site settings
The error I was getting had nonce-s0m3h4sh in Firefox browser I wasn’t getting the sha256-s0m3h4sh. But when I just now looked in chrome it was the sha256 one. I suppose that was causing most of my confusion