inline js script tag isn’t being loaded due to csp and idk how to fix it.

Do you see an error concerning the script in your browser console? something like this? [A red error message in a web browser details a security policy violation preventing inline script execution, referencing directives and required keywords like 'unsafe-inline' or a nonce for enabling the script. (Captioned by AI)] You’ll want to add that provided hash ('sha256-xxxxx') to the “content security policy script src” setting found in admin > all site settings

There’s some information in this post that may help: Mitigate XSS Attacks with Content Security Policy [image]Mitigate XSS Attacks with Content Security Policy CSP and third-party integrations When using third-party services like Google Tag Manager, Google Analytics, or advertising services, you may need to adjust your CSP settings. In most cases with Discourse version 3.3.0.beta1 or later, external scripts should work without additional configuration due to the ‘strict-dynamic’ CSP implementation. If you encounter issues, you may need to: Identify the required script sources by monitoring your browser console Add the necessary sources to the content_security_policy_script_src setting For complex integrations like ad services which load external resources, you might need to enable cross-domain rendering (Example PR from discourse-adplugin that does this). Best practices Start with CSP Report-Only mode to identify potential issues Gradually tighten your CSP as you resolve legitimate violations Regularly review your CSP settings and adjust as needed Be cautious when adding permissive directives like 'unsafe-eval' or 'wasm-unsafe-eval' Keep your Discourse instance updated to benefit from the latest CSP improvements

The error I was getting had nonce-s0m3h4sh in Firefox browser I wasn’t getting the sha256-s0m3h4sh. But when I just now looked in chrome it was the sha256 one. I suppose that was causing most of my confusion

Can't get script tag to work in landing pages plugin due to content-security-policy

Product Support

TheNab June 30, 2025, 5:14pm 3

I’ve read through that and others but cannot piece together how to actually add the exception to the content_security_policy_script_src

Topic		Replies	Views
"Refused to load the script" when adding adsense Product Support	2	1542	February 8, 2019
GTM Refused to load the script because it violates the Content Security Policy Data & reporting	2	3795	June 16, 2021
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25884	June 13, 2023
After upgrade the content security policy script src for GTM Data & reporting	4	1993	April 13, 2021
How to fix problem with CSP Product Support	8	6908	March 9, 2022

Can't get script tag to work in landing pages plugin due to content-security-policy

Related topics