# How to fix problem with CSP
**URL:** https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523
**Category:** Support
**Created:** [March 9, 2022, 3:42pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523 "2022-03-09T15:42:06Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@GreenOWL](https://meta.discourse.org/u/GreenOWL)
#### Post date: [March 9, 2022, 3:42pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/1 "2022-03-09T15:42:06Z")
Hello! I’m have problem with CSP, how to fix this?
```plaintext
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src https://mydomain.com/logs/ https://mydomain.com/sidekiq/ https://mydomain.com/mini-profiler-resources/ https://mydomain.com/assets/ https://mydomain.com/brotli_asset/ https://mydomain.com/extra-locales/ https://mydomain.com/highlight-js/ https://mydomain.com/javascripts/ https://mydomain.com/plugins/ https://mydomain.com/theme-javascripts/ https://mydomain.com/svg-sprite/ https://mydomain.com". Either the 'unsafe-inline' keyword, a hash ('sha256-ScCk7JwXKy22dTO0VFM7aV1chV+yd/MUda4X6VnGans='), or a nonce ('nonce-...') is required to enable inline execution.
```
For the test, I went into a `safe mode`, in [safe mode](https://meta.discourse.org/t/53504?silent=true) there is the same problem.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [March 9, 2022, 4:30pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/2 "2022-03-09T16:30:27Z")
It’s not my forte, but I’ve had a search and you may need to rewrite the inline script you’re trying to use:
> [@Refuse to reload script (CORS) with my settings](https://meta.discourse.org/t/refuse-to-reload-script-cors-with-my-settings/177864/2):
>
> That error means you are trying to run a script inline, which is disallowed by your current CSP configuration.
>
> You have two options:
>
> 1. Fix the script that is trying to execute the inline. (recommended)
> 2. Disable CSP (not recommended)
---
### Author:  [@GreenOWL](https://meta.discourse.org/u/GreenOWL)
#### Post date: [March 9, 2022, 4:56pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/3 "2022-03-09T16:56:33Z")
I don’t want to disable CSP protection and I don’t have external scripts, I tried to disable all the plugins and the components of the topic, it didn’t help.
I try add all this link to `content security policy script src` in the admin setting, problem was safe :frowning:
[https://mydomain.com/logs/](https://mydomain.com/logs/) [https://mydomain.com/sidekiq/](https://mydomain.com/sidekiq/) [https://mydomain.com/mini-profiler-resources/](https://mydomain.com/mini-profiler-resources/) [https://mydomain.com/assets/](https://mydomain.com/assets/) [https://mydomain.com/brotli\_asset/](https://mydomain.com/brotli_asset/) [https://mydomain.com/extra-locales/](https://mydomain.com/extra-locales/) [https://mydomain.com/highlight-js/](https://mydomain.com/highlight-js/) [https://mydomain.com/javascripts/](https://mydomain.com/javascripts/) [https://mydomain.com/plugins/](https://mydomain.com/plugins/) [https://mydomain.com/theme-javascripts/](https://mydomain.com/theme-javascripts/) [https://mydomain.com/svg-sprite/](https://mydomain.com/svg-sprite/) [https://mydomain.com`](https://mydomain.com%60)
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [March 9, 2022, 5:44pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/4 "2022-03-09T17:44:11Z")
You need to share your site URL for we to be able to help you.
---
### Author:  [@GreenOWL](https://meta.discourse.org/u/GreenOWL)
#### Post date: [March 9, 2022, 5:47pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/5 "2022-03-09T17:47:38Z")
I can send it to you’re PM?
---
### Author:  [@GreenOWL](https://meta.discourse.org/u/GreenOWL)
#### Post date: [March 9, 2022, 6:06pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/6 "2022-03-09T18:06:37Z")
Hm…
It seems I found the reason, it seems that the problem occurs because I use the meta tag CSP in my theme:
``
I need to use the `img-src` directive to limit the display of images from prohibited hosts.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [March 9, 2022, 6:36pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/7 "2022-03-09T18:36:34Z")
Oh that CSP directive will indeed break Discourse completely.
---
### Author:  [@GreenOWL](https://meta.discourse.org/u/GreenOWL)
#### Post date: [March 9, 2022, 6:53pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/8 "2022-03-09T18:53:10Z")
How I can change the default CSP directives in header, to added `img-src` without use meta tag? I’m try this in Rails, but nothing change:
```plaintext
Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://mydomain.com/logs/ https://mydomain.com/sidekiq/ https://mydomain.com/mini-profiler-resources/ https://mydomain.com/assets/ https://mydomain.com/brotli_asset/ https://mydomain.com/extra-locales/ https://mydomain.com/highlight-js/ https://mydomain.com/javascripts/ https://mydomain.com/plugins/ https://mydomain.com/theme-javascripts/ https://mydomain.com/svg-sprite/; worker-src 'self' https://mydomain.com/assets/ https://mydomain.com/brotli_asset/ https://mydomain.com/javascripts/ https://mydomain.com/plugins/; frame-ancestors 'self'; manifest-src 'self'; img-src data: https://mydomain.com https://imgur.com"})
```
---
### Author:  [@GreenOWL](https://meta.discourse.org/u/GreenOWL)
#### Post date: [March 9, 2022, 9:07pm UTC](https://meta.discourse.org/t/how-to-fix-problem-with-csp/220523/9 "2022-03-09T21:07:58Z")
I’m delete this meta tag, bebuild and problem was safe :frowning: