# DISCOURSE\_CDN\_URL causes content security policy violations?
**URL:** https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935
**Category:** Self-hosting
**Tags:** cdn
**Created:** [February 6, 2020, 9:51pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935 "2020-02-06T21:51:29Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 6, 2020, 9:51pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935/1 "2020-02-06T21:51:29Z")
I don’t know how I’m screwing this up. I can’t see how I’m the only one facing what looks like a bug.
If I define
```
DISCOURSE_CDN_URL: https://lcsupport-92e2.kxcdn.com
```
in the `env:` stanza in my `yml` for a fairly standard multisite configuration. All of the CDN urls get rejected by the browser as a CSP error.
`content security policy script src` claims “Additional whitelisted script sources. The current host and CDN are included by default. See [Mitigate XSS Attacks with Content Security Policy.](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)”, but when I define it (or add/remove it to `discourse.conf` and `sv restart unicorn`), I get this:
even with `content security policy report only` set to true, the site still won’t load.
Turning off `content_security_policy` or adding the CDN URL to `content security policy script src` seems to be required to get the browser to load the assets.
[here](https://gist.github.com/pfaffman/33aa73b2b7058d28f64452d04d547876) is my `yml`.
---
### Author:  [@xrav3nz](https://meta.discourse.org/u/xrav3nz)
#### Post date: [February 6, 2020, 10:14pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935/2 "2020-02-06T22:14:58Z")
CDN URLs should be computed and included in the CSP by default. Could you also provide (or try comparing) the actual CSP served in the header and the source of the blocked assets?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 6, 2020, 10:45pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935/3 "2020-02-06T22:45:40Z")
Here is the header:
```plaintext
content-security-policy-report-only: base-uri 'none'; object-src 'none'; script-src 'report-sample'
https://support.literatecomputing.com/logs/
https://support.literatecomputing.com/sidekiq/
https://support.literatecomputing.com/mini-profiler-resources/
https://abedmulti-92e2.kxcdn.com/uploads/assets/
https://abedmulti-92e2.kxcdn.com/uploads/brotli_asset/
https://support.literatecomputing.com/extra-locales/
https://lcsupport-92e2.kxcdn.com/highlight-js/
https://lcsupport-92e2.kxcdn.com/javascripts/
https://lcsupport-92e2.kxcdn.com/plugins/
https://lcsupport-92e2.kxcdn.com/theme-javascripts/
https://lcsupport-92e2.kxcdn.com/svg-sprite/
https://www.google-analytics.com/analytics.js
https://tagmanager.google.com/
https://www.googletagmanager.com/; worker-src 'self' blob:
```
Here are the ENV variables inside the container:
```plaintext
root@support-multi:/var/www/discourse# echo $DISCOURSE_S3_UPLOAD_BUCKET
abed-multi/uploads
root@support-multi:/var/www/discourse# echo $DISCOURSE_S3_CDN_URL
https://abedmulti-92e2.kxcdn.com/uploads
```
Here is the CDN URL from `discourse.conf`:
```
cdn_url = 'https://lcsupport-92e2.kxcdn.com'
```
and rails:
```plaintext
[1] pry(main)> GlobalSetting.cdn_url
=> "https://lcsupport-92e2.kxcdn.com"
```
And here is the URL for one of the assets that won’t load: `https://lcsupport-92e2.kxcdn.com/brotli_asset/preload-store-d32dcf974dddcac742f8a7a6aa7fcd686185920b201029d0ecb2b85527ef9034.js`
---
### Author:  [@xrav3nz](https://meta.discourse.org/u/xrav3nz)
#### Post date: [February 6, 2020, 11:11pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935/4 "2020-02-06T23:11:15Z")
So we have this in the CSP
```plaintext
https://abedmulti-92e2.kxcdn.com/uploads/assets/
https://abedmulti-92e2.kxcdn.com/uploads/brotli_asset/
# i.e. DISCOURSE_S3_CDN_URL + /brotli_asset/
```
But the actual address is
```plaintext
https://lcsupport-92e2.kxcdn.com/brotli_asset/preload-store-d32dcf974dddcac742f8a7a6aa7fcd686185920b201029d0ecb2b85527ef9034.js
# i.e. DISCOURSE_CDN_URL + /brotli_asset/...
```
The relevant CSP code:
>
We prioritize using `DISCOURSE_S3_CDN_URL` for assets when available. This aligns with [the CDN asset URL generation](https://github.com/discourse/discourse/blob/697d4720dfdbff1a3c4335a096763c84b52e34e0/app/helpers/application_helper.rb#L60-L72).
@pfaffman Does `GlobalSetting.use_s3?` return `true` for your site?
I wonder if we need an additional `GlobalSetting.use_s3?` check here. Does having `GlobalSetting.s3_cdn_url` necessarily imply `GlobalSetting.use_s3?`? I’m a bit hazy with asset genereation / S3 CDN now 😅 could someone more familiar with it also take a look? Thanks!
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 6, 2020, 11:23pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935/5 "2020-02-06T23:23:21Z")
Well, I tried setting `use_s3` and then `rake assets:precompile` and there’s no change.
I’ve somewhere else had this issue where there was confusion about whether assets were in s3 or local (or their CDN mirrors).