带有嵌入式 Twitter 动态的社区

[Johani (Joe)]

@aliyosefzai

取消勾选此选项是否有任何安全风险？

是的，不建议取消勾选该设置。CSP（内容安全策略）默认启用，原因非常充分。如果您需要白名单化一些通常会被 CSP 标记的脚本，可以将它们添加到您站点的 content_security_policy_script_src 设置中，这样它们就能正常工作而不会出现问题。如果您想进一步了解，可以阅读：

Mitigate XSS Attacks with Content Security Policy

This guide explains how to use Content Security Policy (CSP) to mitigate Cross-Site Scripting (XSS) attacks in Discourse. It covers CSP basics, configuration, and best practices. Required user level: Administrator Summary Content Security Policy (CSP) is a crucial security feature in Discourse that helps protect against Cross-Site Scripting (XSS) and other injection attacks. This guide covers the basics of CSP, how it’s implemented in Discourse, and how to c…