# Automatically adding theme scripts to CSP

**URL:** <https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028>\
**Category:** Development\
**Tags:** dev-news\
**Created:** [April 23, 2020, 5:05pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028 "2020-04-23T17:05:07Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [April 23, 2020, 5:05pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/1 "2020-04-23T17:05:07Z")

</div>

We often see support topics from people trying to add external javascript references to their themes. By default, the content security policy will block this, and the admin has to manually add the script to the CSP site setting (or a theme setting/modifier).

However, @Johani made an excellent suggestion on how we can improve it.

Rather than asking theme developers to copy/paste things around the admin UI, we can do this automatically. We can parse all of the HTML in a theme, extract the src of any external scripts, and add it to the CSP.

After all, computers are a lot better at repetitive copy/paste than humans!

I opened a PR which implements that:

[https://github.com/discourse/discourse/pull/9531](https://github.com/discourse/discourse/pull/9531)

---

_[View the full topic](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028)._