Content-Security-Policy now uses 'strict-dynamic'

[david (David Taylor)]

From v3.3.0.beta1, Discourse implements a ‘strict-dynamic’ Content Security Policy (CSP). This will eliminate the need for manual CSP config, and will greatly improve compatibility with external tooling like tag-managers and advertising.

As a site administrator, you don’t need to do anything. The change will take effect automatically, and any external scripts you’re using will keep working.

No changes are required for themes. A small number of plugins ^[1] may need a small tweak for compatibility with this change (e.g. 1, 2).

Forums which previously disabled CSP for compatibility with external scripts should now be able to re-enable it without any issues or configuration effort.

For the technical details, check out this topic:

Experimenting with a 'strict-dynamic' Content Security Policy (CSP)

We’re experimenting with a new ‘strict-dynamic’ CSP, which should make it much easier to integrate themes, plugins and external scripts with Discourse in a secure way. You can try out the new mode by enabling the ‘content security policy strict dynamic’ site setting. Please let us know if you have any feedback! We hope to make this the default in the near future, and will make an announcements topic as we get closer to that goal. For more information, see below: Background Back in …

For now, it is still possible to switch back to the old system by disabling the ‘content security policy strict dynamic’ site setting. If you have any reason to do this, please let us know! As it stands, we intend to drop support for the old mode in v3.3.0.beta2.

---

1. technically: those which introduce <script> elements via register_html_builder or an erb template ↩︎