CSP error: Couldn't parse invalid host /theme-javascripts/

[Rina_Fallingstar]

Since the latest update ( 2.5.0.beta3) our discourse forum keeps showing the following errors in the browsers dev console :

Any component that contains javascripts return this browser warrning.

Is there any CSP setting I’m missing?

[codinghorror (Jeff Atwood)]

What do you make of this @david?

[david (David Taylor)]

That is strange, the CSP should include the hostname at the beginning of those URLs. Have you configured a CDN on your forum (check app.yml for a DISCOURSE_CDN_URL line).

If you’re able to share a link to your forum, that would also be useful.

We found the cause, it will be addressed soon. In the meantime, it shouldn’t be causing any issues except for the console warnings

Automatically adding theme scripts to CSP

I am seeing some console errors locally: [image] In production environments, I also see sources added in the format https://CDN_SERVER/theme-javascripts/31657759d037d8c06397e9965a1113169100846e.js... which is redundant, because the policy already whitelists https://CDN_SERVER/theme-javascripts. Probably limit the auto-extension to to external script sources only?

[david (David Taylor)]

Should be resolved by

https://github.com/discourse/discourse/commit/f95609ae23ce1604b5f53c9d232e66895cfc9ee7

[Rina_Fallingstar]

Thank you very much!