I don’t know how I’m screwing this up. I can’t see how I’m the only one facing what looks like a bug. If I define DISCOURSE_CDN_URL: https://lcsupport-92e2.kxcdn.com in the env: stanza in my yml for a fairly standard multisite configuration. All of the CDN urls get rejected by the browser as a …

CDN URLs should be computed and included in the CSP by default. Could you also provide (or try comparing) the actual CSP served in the header and the source of the blocked assets?

Here is the header: content-security-policy-report-only: base-uri 'none'; object-src 'none'; script-src 'report-sample' https://support.literatecomputing.com/logs/ https://support.literatecomputing.com/sidekiq/ https://support.literatecomputing.com/mini-profiler-resources/ https://abedmulti-92e…

So we have this in the CSP https://abedmulti-92e2.kxcdn.com/uploads/assets/ https://abedmulti-92e2.kxcdn.com/uploads/brotli_asset/ # i.e. DISCOURSE_S3_CDN_URL + /brotli_asset/ But the actual address is https://lcsupport-92e2.kxcdn.com/brotli_asset/preload-store-d32dcf974dddcac742f8a7a6aa7fcd6861…

Well, I tried setting use_s3 and then rake assets:precompile and there’s no change. I’ve somewhere else had this issue where there was confusion about whether assets were in s3 or local (or their CDN mirrors).

DISCOURSE_CDN_URL causa violações de política de segurança de conteúdo?

Suporte Instalação

xrav3nz Fevereiro 6, 2020, 10:14pm 2

As URLs do CDN devem ser computadas e incluídas na CSP por padrão. Você também poderia fornecer (ou tentar comparar) a CSP real enviada no cabeçalho e a origem dos recursos bloqueados?

Tópico		Respostas	Visualizações
CDN URL must be added to csp script src Self-hosting cdn	3	801	16 de Abril de 2020
Admin upgrade page doesn't load with a CDN Support	3	1187	4 de Novembro de 2020
Assets not serving from CDN in latest update Support	16	2024	7 de Fevereiro de 2020
Defining DISCOURSE_S3_CDN_URL links to assets in S3 CDN URL Support	42	7507	22 de Abril de 2020
Refused to load the script 'site.com/cdn-cgi/speculation' because it violates the following Content Security Policy directive Support content-security-policy	3	8609	22 de Setembro de 2024

DISCOURSE_CDN_URL causa violações de política de segurança de conteúdo?

Tópicos relacionados