I don’t know how I’m screwing this up. I can’t see how I’m the only one facing what looks like a bug. If I define DISCOURSE_CDN_URL: https://lcsupport-92e2.kxcdn.com in the env: stanza in my yml for a fairly standard multisite configuration. All of the CDN urls get rejected by the browser as a …

CDN URLs should be computed and included in the CSP by default. Could you also provide (or try comparing) the actual CSP served in the header and the source of the blocked assets?

Here is the header: content-security-policy-report-only: base-uri 'none'; object-src 'none'; script-src 'report-sample' https://support.literatecomputing.com/logs/ https://support.literatecomputing.com/sidekiq/ https://support.literatecomputing.com/mini-profiler-resources/ https://abedmulti-92e…

So we have this in the CSP https://abedmulti-92e2.kxcdn.com/uploads/assets/ https://abedmulti-92e2.kxcdn.com/uploads/brotli_asset/ # i.e. DISCOURSE_S3_CDN_URL + /brotli_asset/ But the actual address is https://lcsupport-92e2.kxcdn.com/brotli_asset/preload-store-d32dcf974dddcac742f8a7a6aa7fcd6861…

Well, I tried setting use_s3 and then rake assets:precompile and there’s no change. I’ve somewhere else had this issue where there was confusion about whether assets were in s3 or local (or their CDN mirrors).

DISCOURSE_CDN_URL 导致内容安全策略违规？

支持安装

xrav3nz 2020 年2 月 6 日 22:14 2

默认情况下，应计算 CDN 网址并将其包含在 CSP 中。您能否提供（或尝试对比）响应头中实际服务的 CSP 以及被阻止资源的来源？

话题		回复	浏览量
CDN URL must be added to csp script src Self-hosting cdn	3	800	2020 年4 月 16 日
Admin upgrade page doesn't load with a CDN Support	3	1187	2020 年11 月 4 日
Assets not serving from CDN in latest update Support	16	2024	2020 年2 月 7 日
Defining DISCOURSE_S3_CDN_URL links to assets in S3 CDN URL Support	42	7507	2020 年4 月 22 日
Refused to load the script 'site.com/cdn-cgi/speculation' because it violates the following Content Security Policy directive Support content-security-policy	3	8609	2024 年9 月 22 日

DISCOURSE_CDN_URL 导致内容安全策略违规？

相关话题