We’re currently trying to integrate the payment provider Steady – Du machst Medien. Wir den Rest. into our discourse site. Unfortunately, I don’t get their javascript code past our content security policy. I whitelisted every domain I could find in the code, but still get this in the developer conso…

I think the script you’re trying to integrate uses eval() which is blocked by default (the reason is explained in the link above) so you need to add 'unsafe-eval' to your CSP setting if you want that to work.

Why do you think this is a CSP error? (If it was, the code wouldn’t even run, and it is, because it throws an error).

[图片] RGJ: Why do you think this is a CSP error? Everything works as expected, when I deactivate the content security policy, so this was the best guess I could come up with. :wink: Thanks for the hint! Do you have a tip on how to solve this?

需要帮助解决内容安全策略问题

产品支持

Johani (Joe) 2020 年5 月 16 日 00:31 4

我认为您试图集成的脚本使用了 eval()，该函数默认被阻止（原因详见上方链接）。如果您希望其正常工作，需要在 CSP 设置中添加

'unsafe-eval'

话题		回复	浏览量
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25757	2023 年6 月 13 日
After upgrade the content security policy script src for GTM Data & reporting	4	1987	2021 年4 月 13 日
Can't get script tag to work in landing pages plugin due to content-security-policy Product Support	4	288	2025 年7 月 1 日
Cannot add content security policy script src Product Support	2	201	2025 年1 月 1 日
When install html script facing issue? Product Support	8	1724	2020 年4 月 25 日

需要帮助解决内容安全策略问题

相关话题