I don’t know how I’m screwing this up. I can’t see how I’m the only one facing what looks like a bug. If I define DISCOURSE_CDN_URL: https://lcsupport-92e2.kxcdn.com in the env: stanza in my yml for a fairly standard multisite configuration. All of the CDN urls get rejected by the browser as a …

Here is the header: content-security-policy-report-only: base-uri 'none'; object-src 'none'; script-src 'report-sample' https://support.literatecomputing.com/logs/ https://support.literatecomputing.com/sidekiq/ https://support.literatecomputing.com/mini-profiler-resources/ https://abedmulti-92e…

So we have this in the CSP https://abedmulti-92e2.kxcdn.com/uploads/assets/ https://abedmulti-92e2.kxcdn.com/uploads/brotli_asset/ # i.e. DISCOURSE_S3_CDN_URL + /brotli_asset/ But the actual address is https://lcsupport-92e2.kxcdn.com/brotli_asset/preload-store-d32dcf974dddcac742f8a7a6aa7fcd6861…

Well, I tried setting use_s3 and then rake assets:precompile and there’s no change. I’ve somewhere else had this issue where there was confusion about whether assets were in s3 or local (or their CDN mirrors).

DISCOURSE_CDN_URL causes content security policy violations?

Support Self-hosting

xrav3nz February 6, 2020, 10:14pm 2

CDN URLs should be computed and included in the CSP by default. Could you also provide (or try comparing) the actual CSP served in the header and the source of the blocked assets?

Topic		Replies	Views
CDN URL must be added to csp script src Self-hosting cdn	3	800	April 16, 2020
Admin upgrade page doesn't load with a CDN Support	3	1187	November 4, 2020
Assets not serving from CDN in latest update Support	16	2023	February 7, 2020
Defining DISCOURSE_S3_CDN_URL links to assets in S3 CDN URL Support	42	7507	April 22, 2020
Refused to load the script 'site.com/cdn-cgi/speculation' because it violates the following Content Security Policy directive Support content-security-policy	3	8609	September 22, 2024

DISCOURSE_CDN_URL causes content security policy violations?

Related topics