(legacy.111147.js:32)
at n (legacy.111147.js:1)
at legacy.111147.js:1
at legacy.111147.js:1
```
anyone know how to settle this issue ? if i unable CSP the script will working fine . but how to enable CSP and working on it too ?
---
### Author:  [@hawm](https://meta.discourse.org/u/hawm)
#### Post date: [April 19, 2020, 5:48am UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/2 "2020-04-19T05:48:15Z")
Add your script source to setting `content security policy script src`.
---
### Author:  [@BishopV](https://meta.discourse.org/u/BishopV)
#### Post date: [April 19, 2020, 5:50am UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/3 "2020-04-19T05:50:40Z")
i added those error link when i saw from console tab 🙂
 
but still cannot working fine
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 19, 2020, 4:43pm UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/4 "2020-04-19T16:43:16Z")
You are using the feature incorrectly, you only need to whitelist the domain not every single individual URL.
Perhaps the copy needs to be improved here @tshenry?
---
### Author:  [@BishopV](https://meta.discourse.org/u/BishopV)
#### Post date: [April 20, 2020, 3:25pm UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/5 "2020-04-20T15:25:33Z")
thanks for assist , i will try to amend agian.
---
### Author:  [@BishopV](https://meta.discourse.org/u/BishopV)
#### Post date: [April 20, 2020, 3:30pm UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/6 "2020-04-20T15:30:43Z")
but still the issue there , the purechat script cannot showing out , if i enable CSP . even thought i added 2 new link.
---
### Author:  [@tshenry](https://meta.discourse.org/u/tshenry)
#### Post date: [April 20, 2020, 7:06pm UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/7 "2020-04-20T19:06:24Z")
Full disclosure - I do not consider myself a CSP guru!
With that said, I _think_ there are scenarios where it would be ideal to whitelist the domain, and other scenarios where it’s better to target the individual scripts. I’m pretty sure it depends on how many scripts you find you need to whitelist, whether you trust the source, etc. I’ll add a note to the guide that mentions that you can use the domain as a cover-all if needed.
The settings in the provided screenshots definitely were a little overkill, but I imagine that was just an attempt to cover **everything** since nothing was working.
I just tried adding Pure Chat to my test site as an experiment. I could get it working on Chrome using a hash, but it wasn’t enough for Safari and Firefox. I ran it by Penar and this does appear to be one of those unfortunate situations that will requrire `'unsafe-inline'` as mentioned in:
> [@Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/1):
>
> #### 4. Third-Party Script / Service Integration
>
> Different integrations will have different requirements, but can be addressed similarly.
>
> You could look up the integration’s recommended CSP whitelist, and extend the default CSP accordingly. I suggest simply [turn on CSP Report Only mode in Discourse](#heading--available-settings), and watch your console to determine which resources you’ll need to whitelist to make your integrations work.
>
> This is especially important when using third-party script bundlers like Google Tag Manager or Segment, because these bundlers might load many third-party or inline scripts. (You might even end up adding `'unsafe-inline'` when using Segment or GTM, even though this definition should be avoided as much as possible.)
* * *
@BishopV I think your only option if you choose to stay with Pure Chat is to remove all of the entries you have in that setting and add `'unsafe-inline'` at the cost of security.
Have you considered using [Setup HubSpot chat Integration](https://meta.discourse.org/t/hubspot-chat-integration/128777) instead? That appears to play very well with our CSP policy.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 20, 2020, 11:02pm UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/8 "2020-04-20T23:02:55Z")
> [@tshenry](#):
>
> I _think_ there are scenarios where it would be ideal to whitelist the domain, and other scenarios where it’s better to target the individual scripts
Regardless, the worst possible outcome is for someone to hard-code 20 unique URLs from the same domain…
---
### Author:  [@BishopV](https://meta.discourse.org/u/BishopV)
#### Post date: [April 25, 2020, 7:49am UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/9 "2020-04-25T07:49:14Z")
thanks for the assist , i think now hubspot is my solution . im glad choose Discourse is my backend a lot of help and support here.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [May 25, 2020, 7:49am UTC](https://meta.discourse.org/t/when-install-html-script-facing-issue/148507/10 "2020-05-25T07:49:16Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.