# Automatically adding theme scripts to CSP

**URL:** https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028
**Category:** Development
**Tags:** dev-news
**Created:** [April 23, 2020, 5:05pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028 "2020-04-23T17:05:07Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [April 27, 2020, 2:25pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/2 "2020-04-27T14:25:16Z")

</div>

I am seeing some console errors locally:

![image](https://global.discourse-cdn.com/meta/optimized/3X/e/8/e8f875c493782daa0b462a761a6317656856a968_2_690x21.png)

In production environments, I also see sources added in the format `https://CDN_SERVER/theme-javascripts/31657759d037d8c06397e9965a1113169100846e.js...` which is redundant, because the policy already whitelists `https://CDN_SERVER/theme-javascripts`. Probably limit the auto-extension to to external script sources only?

---

_[View the full topic](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028)._