# Mitigate XSS Attacks with Content Security Policy
**URL:** https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243
**Category:** Site Management
**Tags:** how-to, content-security-policy
**Created:** [December 14, 2018, 4:38pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243 "2018-12-14T16:38:20Z")
**Posts on this page:** 13
**Page:** 2
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [July 19, 2021, 7:12pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/38 "2021-07-19T19:12:44Z")
> [@Falco](#):
>
> This directive will be enabled by default in the next release cycle.
As promised, this feature was just enabled by default: [CSP Frame Ancestors enabled by default](https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615)
---
### Author:  [@Fabrice](https://meta.discourse.org/u/Fabrice)
#### Post date: [July 5, 2022, 8:06pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/40 "2022-07-05T20:06:19Z")
Hello,
I am currently setting up Google Adsense on my website and seems I am missing the “Enable CSP violation report collection at /csp\_reports” settings.. I am currently self-hosting Discourse on version 2.9.0.beta6
> [@pmusaraj](#):
>
> 
above, in quote, a screenshot of the setting I am missing
above, my setting page for CSP with the “Enable CSP violation report collection at /csp\_reports” missing.
Any help is appreciated ! And please tell me if I set-up the settings I have correctly for Adsense, I never used it before 👀 !
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [July 13, 2022, 3:55pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/41 "2022-07-13T15:55:31Z")
Apologies, my earlier replies here are outdated because as of ~ a month ago we made `content_security_policy_collect_reports` a hidden setting. You can still enable it but you need to do it via the Rails console, as in:
```plaintext
./launcher enter app
...
rails c
...
SiteSetting.content_security_policy_collect_reports = true
```
Note that this is very noisy, I highly recommend not going down this route at all and simply enabling CSP and navigating the site with the browser console open using multiple browsers (Chrome, Firefox, Safari). You’ll find most issues that way. And with the configuration you have, you’re basically allowing almost all that CSP protects against anyway, so you shouldn’t have any need for the reports.
---
### Author:  [@ReenigneArcher](https://meta.discourse.org/u/ReenigneArcher)
#### Post date: [October 25, 2022, 10:28pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/42 "2022-10-25T22:28:04Z")
Maybe I am missing something, but I do not see these settings in the settings UI.
- `content_security_policy`
- `content_security_policy_report_only`
- `content_security_policy_collect_reports` (I see that is hidden now)
- `content_security_policy_script_src`
Are these options available to hosted instances? I didn’t see any mention of that being a limitation in the original post or comments.
_Edit:_ Also attempted to set the security policy through a theme.
Does not seem to be working as instructed in original post.
I’m assuming the hosted plan I’m on doesn’t allow this, even when done via a theme or theme component?
Or maybe I am just doing something totally wrong.
---
### Author:  [@jkfran](https://meta.discourse.org/u/jkfran)
#### Post date: [November 23, 2022, 7:16pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/47 "2022-11-23T19:16:15Z")
> Currently, Discourse ships a CSP Level 2 policy with the following directives by default:
>
> - `base-uri` restricts the URLs for `` element
Is there any option to override the default value for the `base-uri` header?
---
### Author:  [@MichaIng](https://meta.discourse.org/u/MichaIng)
#### Post date: [January 28, 2023, 11:59am UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/48 "2023-01-28T11:59:36Z")
Where are `` elements actually used in discourse?
---
### Author:  [@hello-smile6](https://meta.discourse.org/u/hello-smile6)
#### Post date: [April 28, 2023, 1:50am UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/49 "2023-04-28T01:50:36Z")
> [@adrelanos](#):
>
> push ‘none’;
Would that break Discourse push notifications?
---
### Author:  [@adrelanos](https://meta.discourse.org/u/adrelanos)
#### Post date: [May 5, 2023, 10:23am UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/50 "2023-05-05T10:23:32Z")
Could be. Might need a more suitable setting.
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [June 12, 2023, 8:35am UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/51 "2023-06-12T08:35:01Z")
A post was split to a new topic: [What’s the suggested method to use secure images?](https://meta.discourse.org/t/what-s-the-suggested-method-to-use-secure-images/268010)
---
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [June 12, 2023, 12:55pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/52 "2023-06-12T12:55:10Z")
Hi there,
May I know how to bypass the issue below? I have added the script invoking a new Function() expression into content\_security\_policy\_script\_src, but my browser console still complains below error. Where I can exclude the unsafe-eval? Thanks!
```plaintext
Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive:
```
---
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [June 12, 2023, 1:22pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/53 "2023-06-12T13:22:53Z")
Apologies. Please ignore my previous post if my below remarks are correct. Just know through above posts I can set ‘unsafe-eval’ directly to content\_security\_policy\_script\_src, and there’s no JS error reported in console any more.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 12, 2023, 2:03pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/54 "2023-06-12T14:03:06Z")
Maybe have a look at the `content security policy script src ` site setting?
---
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [June 13, 2023, 10:50pm UTC](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/55 "2023-06-13T22:50:33Z")
Yes. As said in previous replies ‘unsafe-eval’ can be added directly to content\_security\_policy\_script\_src, I thought only URL base or full URL allowed to add.
[Previous page](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243.md?page=1)