Okay… still on my quest to get my adserver to display on Discourse. I ran across this mystery that I can’t figure out. Using the theme editing feature I have added my script request to both </body> and ‘footer’. If added to the footer (or ‘after header’) the code fails. Even though in inspection mo…

Discourse is a Single Page Application and all the page markup is create client-side via our EmberJS application. Using direct DOM manipulation like document.write is in direct conflict with the whole thing and has a really low change of “just working”. I’d recommend trying to adapt you ads system…

Hopefully a developer will see this one. :slight_smile:

Can I ask that a moderator put this in support or whatever category makes sense. I left it uncategorized. Thanks. And sorry to be such a nudge on this but I am coming up on a deployment deadline and I really need to figure this issue out.

Okay so I noted that the CSP log was showing the Google ads script was being blocked so I added https://pagead2.googlesyndication.com to the CSP script src list and then my Google Adsense ads started appearing (kind of surprised you still have to do that even with the Adsense plugin installed). Th…

So… this is all CSP related (I assume) because the site is set to ‘unsafe-inline’ data and I am trying to pull my adserver script with a URL with variables. I know… how barbaric of me. So… ANYONE? Is there a simple fix for this or should I just give up?

The proper fix is to not use inline and rewrite it to hook into existing EmberJS templates outlets. If you are looking into a band-aid fix, you can disable CSP in the site settings while you work into making the changes to your custom ads solution. Just be aware that may expose you to XSS. You can …

Also where is the Content Security Policy being declared? I don’t see any meta tag for it. Is this just default HTML 5 assumed settings via each browser?

[이미지] Jim_Starkweather: Also where is the Content Security Policy being declared? Check Mitigate XSS Attacks with Content Security Policy

Thanks Falco. Rather than just shut off all protection is there a way I can whitelist data strings for just the adserver URL and allow those variables through. Or… just turn off the “‘unsafe-inline’ data” requirement? I don’t see that option outlined in the article you linked unfortunately. Thanks…

Okay I guess I must be getting desperate, because I did try to shut off the CSP entirely… [image] And yet still the ad will not display in the main section of the site, only the footer where it’s installed in the theme in </body>. I did realize there is a <noscript> wrapper around the center sect…

Thanks for the help Falco. A bit scary but the codebase for this adserver was written prior to the term API being created so… yeah I would be better off writing an entirely new adserver system from scratch. I just don’t have the time for that right now as I am deploying this new forum and 6+ new con…

원격 로드된 JavaScript 콘텐츠에 대해 궁금합니다

제품 지원

Falco (Falco) 12월 7, 2020, 8:06오후 8

Content Security Policy를 이용한 XSS 공격 완화를 확인해 보세요.

글		댓글	조회수
We couldn't find the code on your site Product Support advertising	7	2495	5월 28, 2019
"Refused to load the script" when adding adsense Product Support	2	1536	2월 8, 2019
Google Ads Not Displaying Product Support	9	1466	7월 26, 2019
Adsense CSP Product Support advertising	0	211	6월 14, 2024
Google Ads not showing Product Support	9	735	7월 7, 2023

원격 로드된 JavaScript 콘텐츠에 대해 궁금합니다

Related topics