# CSP error when adding a script via a theme component

**URL:** https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482
**Category:** Development
**Tags:** content-security-policy
**Created:** [August 30, 2024, 1:10pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482 "2024-08-30T13:10:42Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![devops1](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@devops1](https://meta.discourse.org/u/devops1)
#### Post date: [August 30, 2024, 1:10pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/1 "2024-08-30T13:10:42Z")

</div>

### Issue with Strict Dynamic and CSP on Atlassian Widget

I am encountering an issue with Content Security Policy (CSP) after updating to v3.3.0.beta1. Specifically, I’m trying to embed an Atlassian widget in the header of my container, which was created before this update.

Here’s what I’ve added to the header:

```plaintext
<script data-jsd-embedded nonce="{{content_security_policy_nonce}}" data-key="bla" data-base-url="https://jsd-widget.atlassian.com" src="https://jsd-widget.atlassian.com/assets/embed.js"></script>

```

I’ve ensured to include the nonce, but I’m running into the following errors:

```plaintext
embed.js:1 Refused to set the document's base URI to 'https://jsd-widget.atlassian.com/' because it violates the following Content Security Policy directive: "base-uri 'self'".

embed.js:1 Refused to load the script 'https://jsd-widget.atlassian.com/assets/iframe.js' because it violates the following Content Security Policy directive: "script-src 'nonce-YAnMdLzmoWqLis3WXiQKjxdHk' 'strict-dynamic'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

```

Additionally, I came across a suggestion in an earlier post to dynamically load the script like this:

javascript

```plaintext
var s = document.createElement('script');
s.src = "https://jsd-widget.atlassian.com/assets/embed.js";
document.body.appendChild(s);

```

However, this doesn’t seem to resolve the issue. I’m clearly missing something about how `strict-dynamic` is supposed to work in this context.

Can someone help me understand why these errors are occurring and how I might resolve them? Any guidance would be appreciated!

---

<div class="post-metadata">

### Author: ![merefield](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/merefield/32/176214_2.png) [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [August 30, 2024, 1:41pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/2 "2024-08-30T13:41:06Z")

</div>

Funnily enough I was just looking at an almost identical issue.

I can repro a similar issue on latest that was recently rebuilt

I’m getting:

```plaintext
[Report Only] Refused to load the script 'https://www.mytestsite.com/mini-profiler-resources/includes.js?v=116e2a6fd81c286e004e2a0afb03baa1' because it violates the following Content Security Policy directive: "script-src 'nonce-ZSPIEwDBo6e07GuQMDkOFZerD' 'strict-dynamic'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

```

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [August 30, 2024, 2:08pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/3 "2024-08-30T14:08:29Z")

</div>

Can either of you share a link to a site showing this issue? Happy to take a quick look 👀

> [@devops1](#):
>
> Here’s what I’ve added to the header:

If you’ve added this via a theme components, then you should remove the `nonce=` part. Discourse will add it automatically (and I think adding it yourself may break the automatic system)

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [August 30, 2024, 2:17pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/4 "2024-08-30T14:17:45Z")

</div>

> [@merefield](#):
>
> `[Report Only] Refused to load the script /mini-profiler-resources/includes.js`

Closing the loop on this - @merefield and I discussed via PM, and tracked it down to a report-only-specific issue. Fix here: [FIX: Mini-profiler CSP nonce when in report-only mode by davidtaylorhq · Pull Request #28664 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/28664)

So it looks like this is a different issue to the one @devops1 is seeing

---

<div class="post-metadata">

### Author: ![devops1](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@devops1](https://meta.discourse.org/u/devops1)
#### Post date: [September 2, 2024, 9:18am UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/5 "2024-09-02T09:18:55Z")

</div>

Hi David Thanks so much.  
For the quick response

The code I am adding is  
`<script data-jsd-embedded data-key="bla" data-base-url="https://jsd-widget.atlassian.com" src="https://jsd-widget.atlassian.com/assets/embed.js"></script>`

I removed the nonce as requested.

This is the site [https://onlinecommunity.stroke.org.uk/](https://onlinecommunity.stroke.org.uk/)  
I have turned on content security policy report only

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [September 2, 2024, 10:45am UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/6 "2024-09-02T10:45:03Z")

</div>

Is the theme component enabled? I don’t see any atlassian script when I check in dev-tools

---

<div class="post-metadata">

### Author: ![devops1](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@devops1](https://meta.discourse.org/u/devops1)
#### Post date: [September 3, 2024, 2:26pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/7 "2024-09-03T14:26:10Z")

</div>

I think that should work now I found the script in the page source.

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [September 3, 2024, 4:00pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/8 "2024-09-03T16:00:34Z")

</div>

It looks like the `embed.js` script is running successfully, so the Discourse side of things is working.

However, it is then trying to create a same-origin iframe, which includes ‘parser-inserted’ script tags. That kind of strategy is not compatible with a strict-dynamic CSP.

So I think this is something which atlassian would need to fix. I came across [this issue](https://jira.atlassian.com/browse/JSDCLOUD-8438) on their tracker which seems relevant (although doesn’t have much detail, or a resolution 😢)

---

<div class="post-metadata">

### Author: ![devops1](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@devops1](https://meta.discourse.org/u/devops1)
#### Post date: [September 5, 2024, 4:55pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/9 "2024-09-05T16:55:44Z")

</div>

Thanks so much for looking into the issue for me David.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [October 5, 2024, 4:55pm UTC](https://meta.discourse.org/t/csp-error-when-adding-a-script-via-a-theme-component/324482/10 "2024-10-05T16:55:45Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.