# Confused about remotely loaded javascript content

**URL:** https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770
**Category:** Support
**Created:** [November 30, 2020, 6:07pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770 "2020-11-30T18:07:54Z")
**Posts on this page:** 13
**Page:** 1

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [November 30, 2020, 6:07pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/1 "2020-11-30T18:07:54Z")

</div>

Okay… still on my quest to get my adserver to display on Discourse. I ran across this mystery that I can’t figure out. Using the theme editing feature I have added my script request to both `</body>` and ‘footer’.

If added to the footer (or ‘after header’) the code fails. Even though in inspection mode the encoded text seems to be correct. See below:

 ![image](https://global.discourse-cdn.com/meta/original/3X/3/b/3be43a2b8a79e9b06aa6e823b27a4a963a5c4a21.png)

The “Where is this?” text shows up, but nothing else.

However the same script request (below) added to `</body>` works. Why?

`<script language="Javascript" src="https://adserver.kitmaker.net/index.php?section=serve&action=1">`

I have tried adding this to the House Ads data field and again the text is part of the encoded data on the page, but nothing.

`creatives\&quot;:{\&quot;Leaderboard Ad\&quot;:\&quot;\\u003cscript language=\\\&quot;Javascript\\\&quot; src=\\\&quot;https://adserver.kitmaker.net/index.php?section=serve\\u0026action=1\\\&quot;\\u003e\&quot;}},\&quot;`

I am also not seemingly able to get my Adsense ads working by themselves yet, but maybe that is on their end and they just haven’t scanned the site yet to see what to put up. Odd it’s taking this long though.

Thanks for any help.

Jim

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 2, 2020, 5:07pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/2 "2020-12-02T17:07:12Z")

</div>

Hopefully a developer will see this one. 🙂

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 3, 2020, 3:51pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/3 "2020-12-03T15:51:22Z")

</div>

Can I ask that a moderator put this in support or whatever category makes sense. I left it uncategorized.

Thanks. And sorry to be such a nudge on this but I am coming up on a deployment deadline and I really need to figure this issue out.

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 3, 2020, 8:50pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/4 "2020-12-03T20:50:54Z")

</div>

Okay so I noted that the CSP log was showing the Google ads script was being blocked so I added

```
https://pagead2.googlesyndication.com

```

to the CSP script src list and then my Google Adsense ads started appearing (kind of surprised you still have to do that even with the Adsense plugin installed). The thing I noted though is that with my House Ads set to 100% (so that my script is the only one being called) I get ZERO notification in CSP that there is an issue. So that leaves me right back to being confused. The House Ad code is in the HTML (encoded) and appears as above in the browser inspection view.

Is there something blocking the output but not triggering a CSP warning?

The output uses `document.write` to create the ad space. I am guessing that is the culprit. The output looks like this:

 ![image](https://global.discourse-cdn.com/meta/original/3X/a/8/a8a70960f50ae321fbf7d856e0186aacd0fa15fa.png)

Lol… if I put the script output in here in text it was generating just fine. Doh…

I did find this post with a similar issue, but this person figured it out on their own and is clearly better with javascript than I.

> [@\[PAID GIG\] Help with SCRIPT Tag Rendering of Revive Ad Server Tags for Draft Plugin](https://meta.discourse.org/t/paid-gig-help-with-script-tag-rendering-of-revive-ad-server-tags-for-draft-plugin/152057):
>
> Summary Have created a draft of a revive ad server plugin based on a subset of code from the official discourse ad plugin. Basically, I removed the ad networks and refactored the house-ad code (all documented in the README) to serve tags from our revive ad server, filtering for either desktop or mobile ads (Revive does not support responsive tags yet). Here this the current redesign: [https://github.com/unixneo/neo-revive-discourse](https://github.com/unixneo/neo-revive-discourse)Status: Issue with rendering \<script\> tags (sync and async…

As with him though I am willing to pay someone for help with this.

Thanks,  
Jim

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 7, 2020, 7:38pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/5 "2020-12-07T19:38:17Z")

</div>

So… this is all CSP related (I assume) because the site is set to ‘unsafe-inline’ data and I am trying to pull my adserver script with a URL with variables. I know… how barbaric of me.

So… ANYONE? Is there a simple fix for this or should I just give up?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 7, 2020, 8:04pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/6 "2020-12-07T20:04:40Z")

</div>

The proper fix is to not use inline and rewrite it to hook into existing EmberJS templates outlets. If you are looking into a band-aid fix, you can disable CSP in the site settings while you work into making the changes to your custom ads solution. Just be aware that may expose you to XSS.

You can also look into adding your server to a fork of the adplugin, like it was done in this PR: [AdButler support by communiteq · Pull Request #80 · discourse/discourse-adplugin · GitHub](https://github.com/discourse/discourse-adplugin/pull/80/files) or [Carbon Ads Integration by barreeeiroo · Pull Request #73 · discourse/discourse-adplugin · GitHub](https://github.com/discourse/discourse-adplugin/pull/73/files) or even [Add CodeFund Advertising option by coderberry · Pull Request #65 · discourse/discourse-adplugin · GitHub](https://github.com/discourse/discourse-adplugin/pull/65)

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 7, 2020, 8:05pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/7 "2020-12-07T20:05:11Z")

</div>

Also where is the Content Security Policy being declared? I don’t see any meta tag for it. Is this just default HTML 5 assumed settings via each browser?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 7, 2020, 8:06pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/8 "2020-12-07T20:06:03Z")

</div>

> [@Jim\_Starkweather](#):
>
> Also where is the Content Security Policy being declared?

Check [Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 8, 2020, 3:30pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/9 "2020-12-08T15:30:20Z")

</div>

Thanks Falco. Rather than just shut off all protection is there a way I can whitelist data strings for just the adserver URL and allow those variables through. Or… just turn off the “‘unsafe-inline’ data” requirement?

I don’t see that option outlined in the article you linked unfortunately.

Thanks again.

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 8, 2020, 7:25pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/10 "2020-12-08T19:25:18Z")

</div>

Okay I guess I must be getting desperate, because I did try to shut off the CSP entirely…

 ![image](https://global.discourse-cdn.com/meta/original/3X/a/5/a5a8d2afad73418f9855ce3fe617e78ed913c9b3.png)

And yet still the ad **will not display** in the main section of the site, only the footer where it’s installed in the theme in `</body>`. I did realize there is a `<noscript>` wrapper around the center section though and that footer one is outside the close of the `</noscript>` so maybe that is why?

I checked in Firefox and my console now shows no CSP warnings. Not sure why I was never seeing them in Chrome to start with.

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 8, 2020, 7:43pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/11 "2020-12-08T19:43:19Z")

</div>

Discourse is a Single Page Application and all the page markup is create client-side via our EmberJS application.

Using direct DOM manipulation like `document.write` is in direct conflict with the whole thing and has a really low change of “just working”.

I’d recommend trying to adapt you ads system to use our [House Ads in the official Ad Plugin](https://meta.discourse.org/t/house-ads-in-the-official-ad-plugin/116715) system. Maybe you can have a single ad in the house ads inventory, and use the [page change hook](https://meta.discourse.org/t/developer-s-guide-to-discourse-themes/93648#heading--4-c-11) to contact the ad server and replace the ad with the response? Or maybe your ad system can write to the House Ads inventory directly via API?

---

<div class="post-metadata">

### Author: ![Jim\_Starkweather](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jim_starkweather/32/181916_2.png) [@Jim\_Starkweather](https://meta.discourse.org/u/Jim_Starkweather)
#### Post date: [December 9, 2020, 7:52pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/12 "2020-12-09T19:52:26Z")

</div>

Thanks for the help Falco. A bit scary but the codebase for this adserver was written prior to the term API being created so… yeah I would be better off writing an entirely new adserver system from scratch. I just don’t have the time for that right now as I am deploying this new forum and 6+ new content sites as well.

I will play around with some alternate options to using document.write and see if that can work.

Cheers,  
Jim

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [January 8, 2021, 7:52pm UTC](https://meta.discourse.org/t/confused-about-remotely-loaded-javascript-content/171770/13 "2021-01-08T19:52:39Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.