We’re currently trying to integrate the payment provider Steady – Du machst Medien. Wir den Rest. into our discourse site. Unfortunately, I don’t get their javascript code past our content security policy. I whitelisted every domain I could find in the code, but still get this in the developer conso…

I think the script you’re trying to integrate uses eval() which is blocked by default (the reason is explained in the link above) so you need to add 'unsafe-eval' to your CSP setting if you want that to work.

Why do you think this is a CSP error? (If it was, the code wouldn’t even run, and it is, because it throws an error).

[immagine] RGJ: Why do you think this is a CSP error? Everything works as expected, when I deactivate the content security policy, so this was the best guess I could come up with. :wink: Thanks for the hint! Do you have a tip on how to solve this?

Serve aiuto con la Content Security Policy

Assistenza prodotto

RGJ (Richard - Communiteq) 15 Maggio 2020, 4:16pm 2

Perché pensi che si tratti di un errore CSP?

(Se lo fosse, il codice non verrebbe nemmeno eseguito, mentre lo è, dato che genera un errore).

Argomento		Risposte	Visualizzazioni
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25749	Giugno 13, 2023
After upgrade the content security policy script src for GTM Data & reporting	4	1986	Aprile 13, 2021
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	287	Luglio 1, 2025
Cannot add content security policy script src Product Support	2	201	Gennaio 1, 2025
When install html script facing issue? Product Support	8	1724	Aprile 25, 2020

Serve aiuto con la Content Security Policy

Argomenti correlati