# Javascript not working in customised areas

**URL:** https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680
**Category:** Support
**Created:** [May 14, 2019, 11:00am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680 "2019-05-14T11:00:59Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![PaulNicholsonGo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/paulnicholsongo/32/120676_2.png) [@PaulNicholsonGo](https://meta.discourse.org/u/PaulNicholsonGo)
#### Post date: [May 14, 2019, 11:01am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/1 "2019-05-14T11:01:00Z")

</div>

Hello.

I can’t get Javasript working in my customised theme section.  
I have another discourse forum where it works fine. And I’ve never had a problem before.

Simply trying to add the clicky code and the google adsense code to verify the site.  
Driving me mad.

Any help would be awesome.  
[DrinkWithPaul.com](http://DrinkWithPaul.com) is the site.

Thanks in advance.  
Paul

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 14, 2019, 11:03am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/2 "2019-05-14T11:03:25Z")

</div>

Hello @PaulNicholsonGo,

from a quick look at the browser console when browsing on your site, I think this is CSP related. Please make sure you have read [Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)

---

<div class="post-metadata">

### Author: ![PaulNicholsonGo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/paulnicholsongo/32/120676_2.png) [@PaulNicholsonGo](https://meta.discourse.org/u/PaulNicholsonGo)
#### Post date: [May 14, 2019, 11:13am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/3 "2019-05-14T11:13:06Z")

</div>

Ok thanks. I’ll look into that.

What I just noticed is my javascript works on 404 pages…

---

<div class="post-metadata">

### Author: ![PaulNicholsonGo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/paulnicholsongo/32/120676_2.png) [@PaulNicholsonGo](https://meta.discourse.org/u/PaulNicholsonGo)
#### Post date: [May 14, 2019, 11:28am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/4 "2019-05-14T11:28:58Z")

</div>

> [@j.jaffeux](#):
>
> I think this is CSP related.

Yep you got it. I turned it on and off and it started working.

Thanks

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 14, 2019, 11:30am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/5 "2019-05-14T11:30:42Z")

</div>

It’s your choice to put it off, but configuring it to allow only what your want is by far a safer choice.

---

<div class="post-metadata">

### Author: ![PaulNicholsonGo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/paulnicholsongo/32/120676_2.png) [@PaulNicholsonGo](https://meta.discourse.org/u/PaulNicholsonGo)
#### Post date: [May 14, 2019, 11:31am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/6 "2019-05-14T11:31:32Z")

</div>

Cheer but I can’t get it working.  
As soon as it is turned on the thing craps out.

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 14, 2019, 11:32am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/7 "2019-05-14T11:32:28Z")

</div>

You need to add the external domains to the site setting: `content_security_policy_script_src` in your admin settings page.

---

<div class="post-metadata">

### Author: ![PaulNicholsonGo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/paulnicholsongo/32/120676_2.png) [@PaulNicholsonGo](https://meta.discourse.org/u/PaulNicholsonGo)
#### Post date: [May 14, 2019, 11:34am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/8 "2019-05-14T11:34:42Z")

</div>

Yeah I get that.  
Looked at the log to see what csp was blocking.  
Added all the script domains that were showing. And it still never worked on my site.

---

<div class="post-metadata">

### Author: ![PaulNicholsonGo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/paulnicholsongo/32/120676_2.png) [@PaulNicholsonGo](https://meta.discourse.org/u/PaulNicholsonGo)
#### Post date: [May 14, 2019, 11:37am UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/9 "2019-05-14T11:37:40Z")

</div>

> [@j.jaffeux](#):
>
> You need to add the external domains to the site setting: `content_security_policy_script_src` in your admin settings page.

Ok you are right. I added all the domains and it seems to be cool. I see from the logs what I need to add.  
Thanks.

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 15, 2019, 4:00pm UTC](https://meta.discourse.org/t/javascript-not-working-in-customised-areas/117680/10 "2019-05-15T16:00:15Z")

</div>

This topic was automatically closed after 28 hours. New replies are no longer allowed.
