We’re currently trying to integrate the payment provider Steady – Du machst Medien. Wir den Rest. into our discourse site. Unfortunately, I don’t get their javascript code past our content security policy. I whitelisted every domain I could find in the code, but still get this in the developer conso…

I think the script you’re trying to integrate uses eval() which is blocked by default (the reason is explained in the link above) so you need to add 'unsafe-eval' to your CSP setting if you want that to work.

Why do you think this is a CSP error? (If it was, the code wouldn’t even run, and it is, because it throws an error).

[Bild] RGJ: Why do you think this is a CSP error? Everything works as expected, when I deactivate the content security policy, so this was the best guess I could come up with. :wink: Thanks for the hint! Do you have a tip on how to solve this?

Hilfe bei der Content Security Policy benötigt

Produktunterstützung

Krischan (Krischan) 15. Mai 2020 um 19:46 3

Alles funktioniert wie erwartet, wenn ich die Content Security Policy deaktiviere. Das war also die beste Vermutung, die ich hatte. Danke für den Hinweis! Hast du einen Tipp, wie man das lösen kann?

Thema		Antworten	Aufrufe
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25748	13. Juni 2023
After upgrade the content security policy script src for GTM Data & reporting	4	1986	13. April 2021
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	287	1. Juli 2025
Cannot add content security policy script src Product Support	2	201	1. Januar 2025
When install html script facing issue? Product Support	8	1724	25. April 2020

Hilfe bei der Content Security Policy benötigt

Verwandte Themen