Hi, I installed Discourse instance yesterday, and today it shows dark page and in console I see Refused to load the script 'https://ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/rocket-loader.min.js' because it violates the following Content Security Policy directive: "script-src …

Disable cloudflare for your site in your cloudflare control panel. The Rocket Loader feature in particular is absolutely incompatible with Discourse.

Could you please elaborate as to why this is “absolutely” incompatible? I use this on other rails apps that are heavily customized and optimized with success (usually after a little debugging). I’m curious as to why Discourse hasn’t been reworked to make this functional with the full CloudFlare suit…

Ask CloudFlare why, it’s their code, not ours.

There’s not really any benefit or incentive here. You’re appear to be operating under the assumption that Cloudflare can optimize Discourse code better than CDCKs own developers. What are you basing that on? Cloudflare is ok as a cache, but all performance features need to be disabled, otherwise y…

From some discussion I’ve seen on here, there appears to be issues with the meaningful first paint appearing quickly enough in various tests have been returning such results. I was hopeful that Rocket Loader might reduce that further while actual work goes on in this area to resolve it.

No, that will make it worse. Discourse is a JavaScript application, so first load is going to cost a bit more as the app is downloaded into the browser’s JavaScript runtime.

Technically it should work, but if it doesn’t, that’s because Cloudflare wrote bad code. You should mail them about it if you wish to pursue this further. We can’t control Cloudflare’s code because we.. aren’t Cloudflare. I hope that’s clear enough.

Bad CSP policy JS file

지원

codinghorror (Jeff Atwood) 10월 28, 2019, 3:19오전 8

아니요, 그렇게 하면 오히려 더 나빠질 거예요. Discourse는 JavaScript 애플리케이션이기 때문에, 앱이 브라우저의 JavaScript 런타임으로 다운로드되는 과정에서 최초 로딩 시 약간 더 많은 비용이 발생합니다.

글		댓글	조회수
Update from 2.4.0.beta9 to 2.4.0.beta10 yields page with no content - Cloudflare Rocket Loader Self-hosting	11	2006	1월 29, 2020
Blank homescreen Support	3	638	8월 26, 2021
Javascript resources are being blocked by Content Security Policy (Cloudflare Rocket loader) Self-hosting unsupported-install	2	1741	3월 17, 2022
Refused to load the script 'site.com/cdn-cgi/speculation' because it violates the following Content Security Policy directive Support content-security-policy	3	8599	9월 22, 2024
Fresh install stalling at admin access Self-hosting	4	929	3월 15, 2019

Bad CSP policy JS file

Related topics