We’re currently trying to integrate the payment provider Steady – Du machst Medien. Wir den Rest. into our discourse site. Unfortunately, I don’t get their javascript code past our content security policy. I whitelisted every domain I could find in the code, but still get this in the developer conso…

I think the script you’re trying to integrate uses eval() which is blocked by default (the reason is explained in the link above) so you need to add 'unsafe-eval' to your CSP setting if you want that to work.

Why do you think this is a CSP error? (If it was, the code wouldn’t even run, and it is, because it throws an error).

[صورة] RGJ: Why do you think this is a CSP error? Everything works as expected, when I deactivate the content security policy, so this was the best guess I could come up with. :wink: Thanks for the hint! Do you have a tip on how to solve this?

نحتاج إلى مساعدة بخصوص سياسة أمان المحتوى

دعم المنتج

RGJ (Richard - Communiteq) 15 مايو 2020، 4:16م 2

لماذا تعتقد أن هذا خطأ CSP؟

(لو كان كذلك، لما شُغّل الكود حتى، وهو يُشغّل بالفعل، لأنه يُطلق خطأ).

الموضوع		الردود	مرات العرض
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25751	13 يونيو 2023
After upgrade the content security policy script src for GTM Data & reporting	4	1986	13 أبريل 2021
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	287	1 يوليو 2025
Cannot add content security policy script src Product Support	2	201	1 يناير 2025
When install html script facing issue? Product Support	8	1724	25 أبريل 2020

نحتاج إلى مساعدة بخصوص سياسة أمان المحتوى

الموضوعات ذات الصلة