# CDN URL must be added to csp script src

**URL:** <https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270>\
**Category:** Self-hosting\
**Tags:** cdn\
**Created:** [April 16, 2020, 4:52pm UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270 "2020-04-16T16:52:19Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)\
**Post date:** [April 16, 2020, 6:38pm UTC](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270/3 "2020-04-16T18:38:06Z")

</div>

> [@riking](#):
>
> The CSP is supposed to whitelist the specific folders on the S3 and pull CDNs that scripts come from.

I think I understand that. Is that CSP in the static assets that a `rake assets:precompile` makes? (But then why would adding it to the settings fix it.)

> [@riking](#):
>
> What CSP was/is Discourse sending with the page?

I’m afraid that I don’t quite know the canonical way to get the answer to that question.

Not subfolder. A fairly [standard install](https://meta.discourse.org/t/142537?silent=true), though traefik is a reverse proxy in front of it.

---

_[View the full topic](https://meta.discourse.org/t/cdn-url-must-be-added-to-csp-script-src/148270)._