# CDN URL must be added to csp script src
**URL:** https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270
**Category:** Self-hosting
**Tags:** cdn
**Created:** [April 16, 2020, 4:52pm UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270 "2020-04-16T16:52:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [April 16, 2020, 4:52pm UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270/1 "2020-04-16T16:52:19Z")
I’ve got a site configured with ENV like this:
```plaintext
DISCOURSE_FORCE_HTTPS: true
DISCOURSE_S3_ACCESS_KEY_ID: 'KEY'
DISCOURSE_S3_SECRET_ACCESS_KEY: 'SECRET'
DISCOURSE_BACKUP_LOCATION: 's3'
DISCOURSE_ENABLE_S3_UPLOADS: true
DISCOURSE_ENABLE_S3_INVENTORY: false
DISCOURSE_S3_BACKUP_BUCKET: 'mybucket/backups'
DISCOURSE_S3_UPLOAD_BUCKET: 'mybucket'
DISCOURSE_S3_CDN_URL: 'https://mybuckets3.cdn.literatehosting.com'
DISCOURSE_S3_REGION: 'us-west-1'
DISCOURSE_BACKUP_WITH_UPLOADS: 'false'
DISCOURSE_CDN_URL: 'https://mybucket.cdn.literatehosting.com'
```
It worked fine until I added the `s3 cdn url`. After I added the S3 CDN, my browser started rejecting requests to the normal (not S3) CDN. I added the CDN url to `SiteSetting.content_security_policy_script_src=` and then it worked again. This seems like a bug, no? I just did a restart after changes these ENV variables, not a rebuild. Do I need to do a `rake assets:precompile` when I changed the CDN settings?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [April 16, 2020, 5:58pm UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270/2 "2020-04-16T17:58:33Z")
Hmm, this should be working fine. The CSP is supposed to whitelist the specific folders on the S3 and pull CDNs that scripts come from.
What CSP was/is Discourse sending with the page? Is this a subfolder install?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [April 16, 2020, 6:38pm UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270/3 "2020-04-16T18:38:06Z")
> [@riking](#):
>
> The CSP is supposed to whitelist the specific folders on the S3 and pull CDNs that scripts come from.
I think I understand that. Is that CSP in the static assets that a `rake assets:precompile` makes? (But then why would adding it to the settings fix it.)
> [@riking](#):
>
> What CSP was/is Discourse sending with the page?
I’m afraid that I don’t quite know the canonical way to get the answer to that question.
Not subfolder. A fairly [standard install](https://meta.discourse.org/t/142537?silent=true), though traefik is a reverse proxy in front of it.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [April 16, 2020, 6:41pm UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270/4 "2020-04-16T18:41:54Z")
> [@pfaffman](#):
>
> I’m afraid that I don’t quite know the canonical way to get the answer to that question.
`curl -I https://discourse.example.com/` or the Chrome inspector, and get the content of the `Content-Security-Policy` header.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [May 21, 2024, 11:21am UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270/5 "2024-05-21T11:21:04Z")