# DISCOURSE\_CDN\_URL causes content security policy violations?

**URL:** <https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935>\
**Category:** Self-hosting\
**Tags:** cdn\
**Created:** [February 6, 2020, 9:51pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935 "2020-02-06T21:51:29Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![xrav3nz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/xrav3nz/32/76894_2.png) [@xrav3nz](https://meta.discourse.org/u/xrav3nz)\
**Post date:** [February 6, 2020, 10:14pm UTC](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935/2 "2020-02-06T22:14:58Z")

</div>

CDN URLs should be computed and included in the CSP by default. Could you also provide (or try comparing) the actual CSP served in the header and the source of the blocked assets?

---

_[View the full topic](https://meta.discourse.org/t/discourse-cdn-url-causes-content-security-policy-violations/140935)._