# Automatically adding theme scripts to CSP

**URL:** <https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028>\
**Category:** Development\
**Tags:** dev-news\
**Created:** [April 23, 2020, 5:05pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028 "2020-04-23T17:05:07Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [April 27, 2020, 2:59pm UTC](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/4 "2020-04-27T14:59:22Z")

</div>

Thanks @pmusaraj, I added some more checks to make sure we don’t serve invalid urls in the CSP, and also made sure theme-javascript URLs are excluded:

[https://github.com/discourse/discourse/commit/f95609ae23ce1604b5f53c9d232e66895cfc9ee7](https://github.com/discourse/discourse/commit/f95609ae23ce1604b5f53c9d232e66895cfc9ee7)

---

_[View the full topic](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028)._