# CSP error: Couldn't parse invalid host /theme-javascripts/ **URL:** https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255 **Category:** Support **Created:** [April 25, 2020, 11:49am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255 "2020-04-25T11:49:54Z") **Posts on this page:** 6 **Page:** 1
### Author: ![Rina\_Fallingstar](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rina_fallingstar/32/168391_2.png) [@Rina\_Fallingstar](https://meta.discourse.org/u/Rina_Fallingstar) #### Post date: [April 25, 2020, 11:49am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255/1 "2020-04-25T11:49:54Z")
Since the latest update ( 2.5.0.beta3) our discourse forum keeps showing the following errors in the browsers dev console : ![Capture](https://global.discourse-cdn.com/meta/original/3X/6/f/6f110d68cbcc087e79d38025b13d6259e5e9a99e.png) Any component that contains javascripts return this browser warrning. Is there any CSP setting I’m missing? ---
### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror) #### Post date: [April 27, 2020, 2:47am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255/2 "2020-04-27T02:47:26Z")
What do you make of this @david? ---
### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david) #### Post date: [April 27, 2020, 8:51am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255/3 "2020-04-27T08:51:05Z")
~~That is strange, the CSP should include the hostname at the beginning of those URLs. Have you configured a CDN on your forum (check `app.yml` for a `DISCOURSE_CDN_URL` line).~~ ~~If you’re able to share a link to your forum, that would also be useful.~~ We found the cause, it will be addressed soon. In the meantime, it shouldn’t be causing any issues except for the console warnings > [@Automatically adding theme scripts to CSP](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/2): > > I am seeing some console errors locally: [image] In production environments, I also see sources added in the format https://CDN\_SERVER/theme-javascripts/31657759d037d8c06397e9965a1113169100846e.js... which is redundant, because the policy already whitelists https://CDN\_SERVER/theme-javascripts. Probably limit the auto-extension to to external script sources only? ---
### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david) #### Post date: [April 27, 2020, 2:58pm UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255/4 "2020-04-27T14:58:31Z")
Should be resolved by [https://github.com/discourse/discourse/commit/f95609ae23ce1604b5f53c9d232e66895cfc9ee7](https://github.com/discourse/discourse/commit/f95609ae23ce1604b5f53c9d232e66895cfc9ee7) ---
### Author: ![Rina\_Fallingstar](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rina_fallingstar/32/168391_2.png) [@Rina\_Fallingstar](https://meta.discourse.org/u/Rina_Fallingstar) #### Post date: [April 28, 2020, 7:09am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255/5 "2020-04-28T07:09:43Z")
Thank you very much! 🙂 ---
### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david) #### Post date: [May 28, 2020, 7:09am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255/6 "2020-05-28T07:09:48Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.