Issue with Strict Dynamic and CSP on Atlassian Widget I am encountering an issue with Content Security Policy (CSP) after updating to v3.3.0.beta1. Specifically, I’m trying to embed an Atlassian widget in the header of my container, which was created before this update. Here’s what I’ve added to th…

It looks like the embed.js script is running successfully, so the Discourse side of things is working. However, it is then trying to create a same-origin iframe, which includes ‘parser-inserted’ script tags. That kind of strategy is not compatible with a strict-dynamic CSP. So I think this is some…

Funnily enough I was just looking at an almost identical issue. I can repro a similar issue on latest that was recently rebuilt I’m getting: [Report Only] Refused to load the script 'https://www.mytestsite.com/mini-profiler-resources/includes.js?v=116e2a6fd81c286e004e2a0afb03baa1' because it viol…

Can either of you share a link to a site showing this issue? Happy to take a quick look :eyes: [이미지] devops1: Here’s what I’ve added to the header: If you’ve added this via a theme components, then you should remove the nonce= part. Discourse will add it automatically (and I think adding it …

[이미지] Robert: [Report Only] Refused to load the script /mini-profiler-resources/includes.js Closing the loop on this - @merefield and I discussed via PM, and tracked it down to a report-only-specific issue. Fix here: FIX: Mini-profiler CSP nonce when in report-only mode by davidtaylorhq · Pul…

Hi David Thanks so much. For the quick response The code I am adding is <script data-jsd-embedded data-key="bla" data-base-url="https://jsd-widget.atlassian.com" src="https://jsd-widget.atlassian.com/assets/embed.js"></script> I removed the nonce as requested. This is the site https://onlinecom…

Is the theme component enabled? I don’t see any atlassian script when I check in dev-tools

I think that should work now I found the script in the page source.

Thanks so much for looking into the issue for me David.

테마 컴포넌트를 통해 스크립트를 추가할 때 CSP 오류가 발생합니다

개발

david (David Taylor) 9월 2, 2024, 10:45오전 6

테마 구성 요소가 활성화되어 있나요? 개발자 도구를 확인해 보았을 때 Atlassian 스크립트를 찾을 수 없습니다.

글		댓글	조회수
Cannot add content security policy script src Product Support	2	201	1월 1, 2025
Content-Security-Policy now uses 'strict-dynamic' Announcements	12	2068	8월 20, 2024
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	281	7월 1, 2025
After upgrade the content security policy script src for GTM Data & reporting	4	1985	4월 13, 2021
Theme component invalid “extend content security policy” value Bug	3	208	2월 11, 2025

테마 컴포넌트를 통해 스크립트를 추가할 때 CSP 오류가 발생합니다

Related topics