# CSP error: Couldn't parse invalid host /theme-javascripts/

**URL:** https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255
**Category:** Support
**Created:** [April 25, 2020, 11:49am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255 "2020-04-25T11:49:54Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [April 27, 2020, 8:51am UTC](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255/3 "2020-04-27T08:51:05Z")

</div>

~~That is strange, the CSP should include the hostname at the beginning of those URLs. Have you configured a CDN on your forum (check `app.yml` for a `DISCOURSE_CDN_URL` line).~~

~~If you’re able to share a link to your forum, that would also be useful.~~

We found the cause, it will be addressed soon. In the meantime, it shouldn’t be causing any issues except for the console warnings

> [@Automatically adding theme scripts to CSP](https://meta.discourse.org/t/automatically-adding-theme-scripts-to-csp/149028/2):
>
> I am seeing some console errors locally: [image] In production environments, I also see sources added in the format https://CDN\_SERVER/theme-javascripts/31657759d037d8c06397e9965a1113169100846e.js... which is redundant, because the policy already whitelists https://CDN\_SERVER/theme-javascripts. Probably limit the auto-extension to to external script sources only?

---

_[View the full topic](https://meta.discourse.org/t/csp-error-couldnt-parse-invalid-host-theme-javascripts/149255)._