# Scripts in posts?

**URL:** <https://meta.discourse.org/t/scripts-in-posts/361009>\
**Category:** Product Support\
**Created:** [April 9, 2025, 6:39am UTC](https://meta.discourse.org/t/scripts-in-posts/361009 "2025-04-09T06:39:17Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![Olle11](https://avatars.discourse-cdn.com/v4/letter/o/cdc98d/32.png) [@Olle11](https://meta.discourse.org/u/Olle11)\
**Post date:** [April 10, 2025, 10:08am UTC](https://meta.discourse.org/t/scripts-in-posts/361009/9 "2025-04-10T10:08:17Z")

</div>

Perhaps something along these lines to allow a script running in Discourse @merefield @supermathie?

App.yml:  
DISCOURSE\_ALLOW\_UNSAFE\_HTML: true

- volume:  
host: /var/discourse/shared/standalone/nginx\_custom.conf  
guest: /etc/nginx/conf.d/custom.conf

Nginx configuration for CSP:  
add\_header Content-Security-Policy “script-src ‘self’ ‘[https://webadress.com](https://webadress.com)’ ‘unsafe-inline’ ‘unsafe-eval’;”;

I am trying to add the Nginx configuration but both ‘unsafe-inline’ and the https will not show up in the CSP when checking with curl. ‘unsafe-eval’ adds through admin.

Edit: NOT SAFE

---

_[View the full topic](https://meta.discourse.org/t/scripts-in-posts/361009)._