# External nginx pagespeed module causes Security Policy violation
**URL:** https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336
**Category:** Self-hosting
**Created:** [6월 25, 2019, 11:59오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336 "2019-06-25T23:59:38Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@34563463456](https://meta.discourse.org/u/34563463456)
#### Post date: [6월 25, 2019, 11:59오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/1 "2019-06-25T23:59:39Z")
I have posted the detail question on Stack Overflow: [https://stackoverflow.com/questions/56763156/discourse-email-activation-no-longer-works-due-to-content-security-policy-violat](https://stackoverflow.com/questions/56763156/discourse-email-activation-no-longer-works-due-to-content-security-policy-violat)
I boostrapped discourse using my custom `app.yml` which uses the cloudflare template like so:
```
templates:
- "templates/postgres.template.yml"
- "templates/redis.template.yml"
- "templates/web.template.yml"
- "templates/web.ratelimited.template.yml"
- "templates/web.socketed.template.yml"
- "templates/sshd.template.yml"
- "templates/cloudflare.template.yml"
```
Then I bootstrapped the image like so:
```
./launcher bootstrap app &&\
./launcher start app
```
I then register my account, and try clicking on the activation link on my discourse page, and NOTHING happens. Looking at dev tools, I see this error:
```
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'report-sample' http://myfancydomain.com/logs/ http://myfancydomain.com/sidekiq/ http://myfancydomain.com/mini-profiler-resources/ http://myfancydomain.com/assets/ http://myfancydomain.com/brotli_asset/ http://myfancydomain.com/extra-locales/ http://myfancydomain.com/highlight-js/ http://myfancydomain.com/javascripts/ http://myfancydomain.com/plugins/ http://myfancydomain.com/theme-javascripts/ http://myfancydomain.com/svg-sprite/". Either the 'unsafe-inline' keyword, a hash ('sha256-T1n9N/v2ZUyCGncqaO0MgcESijK4iDg9nXYaamEO+bY='), or a nonce ('nonce-...') is required to enable inline execution.
```
I have NO clue what this error means - any clues as to how to solve it would be great.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [6월 26, 2019, 12:44오전 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/2 "2019-06-26T00:44:15Z")
You’ve included the cloudflare template which probably means you’re using it for SSL.
But your CSP has all http schemes instead of https. If you access via https but the CSP says http, that’s a mismatch.
You need to tell Discourse that it’s behind https if that’s the case. Try:
`SiteSetting.force_https = true`
at the rails console.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [6월 26, 2019, 2:07오전 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/3 "2019-06-26T02:07:00Z")
I would leave cloudflare of the mix until you get everything else up and running.
---
### Author:  [@34563463456](https://meta.discourse.org/u/34563463456)
#### Post date: [6월 26, 2019, 5:30오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/4 "2019-06-26T17:30:18Z")
@supermathie: I have tried this approach now and I can confirm that it does not change the situation.
@pfaffman: iI can confirm that it works fine without the CF template.., but not with it.. is this a bug?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [6월 26, 2019, 5:33오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/5 "2019-06-26T17:33:12Z")
> [@34563463456](#):
>
> it works fine without the CF template
Do you have it working with https and without the orange cloud?
---
### Author:  [@34563463456](https://meta.discourse.org/u/34563463456)
#### Post date: [6월 26, 2019, 5:53오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/6 "2019-06-26T17:53:40Z")
@pfaffman: yes it works with https without the orange cloud. So, the first time I set it up, it worked out of the box and since I did not use the cloudflare template I had no CSP issues.
I just saw a [post](https://meta.discourse.org/t/full-site-cdn-acceleration-for-discourse/21467/10) which mentioned: `DISCORSE_ENABLE_CORS: true` should be set. I havent tried it yet however (will try in few mins)
BTW: I have an nginx front end with https (letsencrypt) serving a reverse proxy discourse instance. Thus I had commented out `templates/web.ssl.template.yml` - do you think should include this now that I have the cloudflare template on?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [6월 26, 2019, 6:11오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/7 "2019-06-26T18:11:09Z")
> [@34563463456](#):
>
> BTW: I have an nginx front end with https (letsencrypt) serving a reverse proxy discourse instance.
That would have been good to mention in the OP.
You should probably have a look at the topics about running with an external nginx and look carefully at the stuff that sees that Discourse sees the user IP and then look at the cloudflare template and see that it should still work with your config.
No. I am pretty sure that you don’t want `web.ssl.template.yml`.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [6월 26, 2019, 8:34오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/8 "2019-06-26T20:34:47Z")
> [@34563463456](#):
>
> it does not change the situation
it should have changed the situation since now the CSP should be different
---
### Author:  [@34563463456](https://meta.discourse.org/u/34563463456)
#### Post date: [6월 27, 2019, 10:46오전 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/9 "2019-06-27T10:46:29Z")
This is a bit embarrassing - but I have found out why this was.
Once everything was working without cloudflare, I added the nginx pagespeed module to my nginx config (pagespeed on;)
This was the reason for this error ☹ I found this out browsing through the console within DevTools.
I apologise for wasting your time.
Just to add: I had also asked pagespeed to honourCSP, but this creates the same problems. At this moment, I have removed pagsepeed and everything works great.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [6월 27, 2019, 12:29오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/10 "2019-06-27T12:29:16Z")
That’s a new one to me! I changed the title for others who might have the same issue
---
### Author:  [@34563463456](https://meta.discourse.org/u/34563463456)
#### Post date: [6월 27, 2019, 12:43오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/11 "2019-06-27T12:43:29Z")
@pfaffman: Yea, I was surprised myself.
I normally have `pagespeed on;` by default.
Did not know this would cause trouble.
Hopefully, someone can look into it - I dont really have the skills to debug this (never heard of CSP until a few days ago) ☹
From what I could see, it was related to ember.js which pagespeed was caching.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [6월 27, 2019, 3:24오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/12 "2019-06-27T15:24:30Z")
> [@34563463456](#):
>
> I normally have `pagespeed on;` by default.
That’s a bad idea in this day and age:
> [@Install ngx\_pagespeed](https://meta.discourse.org/t/install-ngx-pagespeed/110218/2):
>
> It will create only problems. The ngx\_pagespeed was made when you can’t change the underlying website and need to fix it at the reverse proxy layer. Discourse already implements all the needed bits, compression, cache headers, etc.
---
### Author:  [@34563463456](https://meta.discourse.org/u/34563463456)
#### Post date: [6월 30, 2019, 9:04오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/13 "2019-06-30T21:04:04Z")
@Falco: Thank you for enlightening me on this.
I understand that pagespeed is not required for Discourse.
Thank you for your fast support!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [7월 30, 2019, 9:04오후 UTC](https://meta.discourse.org/t/external-nginx-pagespeed-module-causes-security-policy-violation/121336/14 "2019-07-30T21:04:05Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.