I’m trying to pul in qrcode.js to generate a QRcode in the browser.
I’m getting blocked by CSP as well. I don’t understand how it’s a CSP problem if it’s on the same host. This is on a production server using discourse_theme to debug.
And it seems that the function doesn’t get called to load the script if I don’t call this.ensureQRCode();, which you don’t seem to be doing in your component.
The script is available and I can retrive it (so I got the stuff in the about.json and /assets/qrcode.js right), but the browser refuses to load it.
This solves CSP, makes the theme self-contained and is considered a good practice, instead of loading it from third-parties.
Load it lazily
Only when needed, you can load it lazily using await loadScript. This means it won’t be loaded in pages where it isn’t needed, slowing your whole site.