According to Mitigate XSS Attacks with Content Security Policy it’s possible to add a set of sources to the CSP policies. I think it would be a great thing to add a group of sources like the ones above for Google AdSense, that way the plugin is easier to setup for non-advanced users. CSP Violation: 'https://partner.googleadservices.com' CSP Violation: 'https://tpc.googlesyndication.com' CSP Violation: 'https://pagead2.googlesyndication.com' CSP Violation: 'https://adservice.google.com' ``

Agreed! I recently had ads stop working on a site for just this reason and it took me a while to track it down.

Is that actually enough? Seems like there are always other assets coming from other domains that cause more CSP violations even with the google*.com ones listed. And google is free to change where the ad assets come from at any time. Also it would be surprising if someone installs the plugin and suddenly they have all these permitted resources (adsense, ad manager, amazon, codefund, carbon ads, and anything else included in the plugin) added to their security settings without asking.

It’s not, but is a good start, Google also sends from localized domains as google.com.mx, or google.co.ve. The other thing, would be to add the CSP impass to the plugin documentation, and let everyone to handle how to work it out.

[图片] marianord: add the CSP impass to the plugin documentation That was added in last September: Discourse Advertising Plugin (Ads)

[图片] pfaffman: I recently had ads stop working on a site for just this reason and it took me a while to track it down. :raised_hand: Same here. It’s always dangerous (bad practice) to enable restrictive settings by default, especially for upgrades. Took a while a figure out what is broken. (This also breaks external cookie consent scripts, which are super annoying but kind of a legal requirement)

We’re not going to give Google js the keys to your community by default, and we can’t add a suggested list of sources to add to CSP settings given how the official Google doc doesn’t include all the necessary sources and can change them at any time (and already has?). Having gone through this with a customer last week (adding 19 sources to get it working), enabling CSP while using Google ads is going to be painful and we can’t automate it in the plugin.

为插件添加 CSP 源

产品支持

Falco (Falco) 2020 年1 月 31 日 16:35 5

该内容已于去年 9 月添加：Discourse Advertising Plugin (Ads)

话题		回复	浏览量
Unable to get Google Ad Manager (DFP) ads to show up Product Support	1	902	2019 年6 月 4 日
Adsense CSP Product Support advertising	0	213	2024 年6 月 14 日
Google Ads Not Displaying Product Support	9	1481	2019 年7 月 26 日
Google Ads not showing Product Support	9	753	2023 年7 月 7 日
We couldn't find the code on your site Product Support advertising	7	2519	2019 年5 月 28 日

为插件添加 CSP 源

相关话题