We’re currently trying to integrate the payment provider Steady – Du machst Medien. Wir den Rest. into our discourse site. Unfortunately, I don’t get their javascript code past our content security policy. I whitelisted every domain I could find in the code, but still get this in the developer conso…

I think the script you’re trying to integrate uses eval() which is blocked by default (the reason is explained in the link above) so you need to add 'unsafe-eval' to your CSP setting if you want that to work.

Why do you think this is a CSP error? (If it was, the code wouldn’t even run, and it is, because it throws an error).

[imagen] RGJ: Why do you think this is a CSP error? Everything works as expected, when I deactivate the content security policy, so this was the best guess I could come up with. :wink: Thanks for the hint! Do you have a tip on how to solve this?

Necesito ayuda con la política de seguridad de contenido

Soporte del producto

Krischan (Krischan) 15 Mayo, 2020 19:46 3

Todo funciona como se esperaba cuando desactivo la política de seguridad de contenido, así que esa fue la mejor suposición que pude hacer. ¡Gracias por la pista! ¿Tienes algún consejo sobre cómo solucionar esto?

Tema		Respuestas	Vistas
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25748	13 Junio 2023
After upgrade the content security policy script src for GTM Data & reporting	4	1986	13 Abril 2021
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	287	1 Julio 2025
Cannot add content security policy script src Product Support	2	201	1 Enero 2025
When install html script facing issue? Product Support	8	1724	25 Abril 2020

Necesito ayuda con la política de seguridad de contenido

Temas relacionados