@PaulNicholsonGo is experiencing issues with JavaScript not working in customised areas of his Discourse forum, DrinkWithPaul.com. After investigating, @joffreyjaffeux suggests that the problem is related to Content Security Policy (CSP). Initially, turning off CSP resolves the issue, but @joffreyjaffeux recommends configuring CSP to allow only necessary external domains for better security.
@joffreyjaffeux advises adding the external domains to the content_security_policy_script_src site setting. After initially struggling to get it working, @PaulNicholsonGo successfully resolves the issue by adding the required domains, as identified in the logs.
Hello.
I can’t get Javasript working in my customised theme section.
I have another discourse forum where it works fine. And I’ve never had a problem before.
Simply trying to add the clicky code and the google adsense code to verify the site.
Driving me mad.
Any help would be awesome.
DrinkWithPaul.com is the site.
Thanks in advance.
Paul
Hello @PaulNicholsonGo,
from a quick look at the browser console when browsing on your site, I think this is CSP related. Please make sure you have read Mitigate XSS Attacks with Content Security Policy
Ok thanks. I’ll look into that.
What I just noticed is my javascript works on 404 pages…
Yep you got it. I turned it on and off and it started working.
Thanks
It’s your choice to put it off, but configuring it to allow only what your want is by far a safer choice.
Cheer but I can’t get it working.
As soon as it is turned on the thing craps out.
You need to add the external domains to the site setting: content_security_policy_script_src in your admin settings page.
Yeah I get that.
Looked at the log to see what csp was blocking.
Added all the script domains that were showing. And it still never worked on my site.
Ok you are right. I added all the domains and it seems to be cool. I see from the logs what I need to add.
Thanks.