I have posted the detail question on Stack Overflow: https://stackoverflow.com/questions/56763156/discourse-email-activation-no-longer-works-due-to-content-security-policy-violat I boostrapped discourse using my custom app.yml which uses the cloudflare template like so: templates: - "templates/p…

This is a bit embarrassing - but I have found out why this was. Once everything was working without cloudflare, I added the nginx pagespeed module to my nginx config (pagespeed on;) This was the reason for this error :frowning: I found this out browsing through the console within DevTools. I apol…

You’ve included the cloudflare template which probably means you’re using it for SSL. But your CSP has all http schemes instead of https. If you access via https but the CSP says http, that’s a mismatch. You need to tell Discourse that it’s behind https if that’s the case. Try: SiteSetting.force_…

I would leave cloudflare of the mix until you get everything else up and running.

@supermathie : I have tried this approach now and I can confirm that it does not change the situation. @pfaffman : iI can confirm that it works fine without the CF template.., but not with it.. is this a bug?

[صورة] 34563463456: it works fine without the CF template Do you have it working with https and without the orange cloud?

@pfaffman : yes it works with https without the orange cloud. So, the first time I set it up, it worked out of the box and since I did not use the cloudflare template I had no CSP issues. I just saw a post which mentioned: DISCORSE_ENABLE_CORS: true should be set. I havent tried it yet however (wil…

[صورة] 34563463456: BTW: I have an nginx front end with https (letsencrypt) serving a reverse proxy discourse instance. That would have been good to mention in the OP. You should probably have a look at the topics about running with an external nginx and look carefully at the stuff that sees…

[صورة] 34563463456: it does not change the situation it should have changed the situation since now the CSP should be different

That’s a new one to me! I changed the title for others who might have the same issue

@pfaffman : Yea, I was surprised myself. I normally have pagespeed on; by default. Did not know this would cause trouble. Hopefully, someone can look into it - I dont really have the skills to debug this (never heard of CSP until a few days ago) :frowning: From what I could see, it was related t…

[صورة] 34563463456: I normally have pagespeed on; by default. That’s a bad idea in this day and age: [صورة] Install ngx_pagespeed Support It will create only problems. The ngx_pagespeed was made when you can’t change the underlying website and nee…

وحدة nginx pagespeed الخارجية تسبب انتهاكًا لسياسة الأمان

الدعم تثبيت

Falco (Falco) 27 يونيو 2019، 3:24م 12

هذه فكرة سيئة في هذا العصر:

الموضوع		الردود	مرات العرض
Keyboard and mouse stopped working + content-security-policy error Self-hosting nginx	6	501	6 نوفمبر 2023
Refused to load the script 'site.com/cdn-cgi/speculation' because it violates the following Content Security Policy directive Support content-security-policy	3	8438	22 سبتمبر 2024
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	24909	13 يونيو 2023
Fresh Discourse install on digitalocean, cannot activate account Self-hosting	14	1541	21 يناير 2019
Using Discourse with Cloudflare: Best Practices Self-Hosting how-to , cloudflare	28	5288	26 أبريل 2026

وحدة nginx pagespeed الخارجية تسبب انتهاكًا لسياسة الأمان

الموضوعات ذات الصلة