New chat
Understand this error
buy-tickets.php?event_id=358&event_date_id=2327:1 Refused to load the stylesheet 'https://fonts.googleapis.com/css2?family=Poppins:wght@400;600;700&display=swap' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.
Understand this error
buy-tickets.js?ver=1.10.10:30 updateOrderSummary called
buy-tickets.js?ver=1.10.10:31 Current orderData: {tickets: Array(1), addOns: Array(0), total: 0}
buy-tickets.php?event_id=358&event_date_id=2327:355 Uncaught SyntaxError: Identifier 'stripe' has already been declared (at buy-tickets.php?event_id=358&event_date_id=2327:355:9)Understand this error
buy-tickets.js?ver=1.10.10:588 DOM Content Loaded – Starting initialization…
buy-tickets.js?ver=1.10.10:2266 Starting fetchEventData…
buy-tickets.js?ver=1.10.10:2267 URL parameters: {event_id: '358', event_date_id: '2327'}
buy-tickets.js?ver=1.10.10:2271 Making request to: /api/events.php?event_id=358&event_date_id=2327
buy-tickets.js?ver=1.10.10:824 DOM Content Loaded – Initializing cart…
buy-tickets.js?ver=1.10.10:787 Initializing cart functionality
buy-tickets.js?ver=1.10.10:808 Cart initialization complete
buy-tickets.js?ver=1.10.10:958 DOM Content Loaded – Initializing step navigation…
buy-tickets.js?ver=1.10.10:967 Initialized Step 1 as active
buy-tickets.js?ver=1.10.10:972 Initialized Step 2 as hidden
buy-tickets.js?ver=1.10.10:977 Initialized Step 3 as hidden
buy-tickets.js?ver=1.10.10:901 Updating navigation buttons for step: 1
buy-tickets.js?ver=1.10.10:1588 DOM Content Loaded – Initializing payment…
buy-tickets.js?ver=1.10.10:1066 Initializing Stripe with Express Checkout…
buy-tickets.js?ver=1.10.10:1144 Card number element mounted successfully
buy-tickets.js?ver=1.10.10:1170 Card expiry element mounted successfully
buy-tickets.js?ver=1.10.10:1196 Card CVC element mounted successfully
buy-tickets.js?ver=1.10.10:1321 Creating Payment Request Button with amount: 3000
buy-tickets.js?ver=1.10.10:1339 Creating payment request button…
buy-tickets.js?ver=1.10.10:1350 Payment Request Button created successfully: t {_emit: ƒ, _once: ƒ, _removeAllListeners: ƒ, _on: ƒ, _validateUserOn: ƒ, …}
buy-tickets.js?ver=1.10.10:1559 Stripe Payment Request Button initialized successfully
VM145:2 Refused to load the script 'https://sibautomation.com/sa.js?key=s2brl8r3ofu5jx9xvsfpk6ib' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://js.stripe.com https://pay.google.com https://www.gstatic.com https://*.gstatic.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
(anonymous) @ VM145:2
(anonymous) @ VM145:2
(anonymous) @ uc92/:684
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
xO @ uc92/:683
(anonymous) @ uc92/:301
k.invoke @ uc92/:216
ab @ uc92/:180
Za @ uc92/:179
(anonymous) @ uc92/:240
k.invoke @ uc92/:216
ab @ uc92/:180
k.Pn @ uc92/:182
df @ uc92/:251
(anonymous) @ uc92/:631
bg @ uc92/:266
e @ uc92/:581
(anonymous) @ uc92/:186
(anonymous) @ uc92/:582
(anonymous) @ uc92/:582
jC @ uc92/:582
nC @ uc92/:587
hD @ uc92/:606
jD @ uc92/:608
setTimeout
Sc @ uc92/:201
kD @ uc92/:611
io @ uc92/:762
(anonymous) @ uc92/:766
c @ uc92/:764
(anonymous) @ uc92/:766
(anonymous) @ uc92/:766
(anonymous) @ uc92/:768Understand this error
VM146:1 Refused to load the script 'https://connect.facebook.net/en_US/fbevents.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://js.stripe.com https://pay.google.com https://www.gstatic.com https://*.gstatic.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
(anonymous) @ VM146:1
(anonymous) @ VM146:1
(anonymous) @ uc92/:684
(anonymous) @ uc92/:685
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
(anonymous) @ uc92/:686
setTimeout
yO @ uc92/:686
xO @ uc92/:683
(anonymous) @ uc92/:301
k.invoke @ uc92/:216
ab @ uc92/:180
Za @ uc92/:179
(anonymous) @ uc92/:240
k.invoke @ uc92/:216
ab @ uc92/:180
k.Pn @ uc92/:182
df @ uc92/:251
(anonymous) @ uc92/:631
bg @ uc92/:266
e @ uc92/:581
(anonymous) @ uc92/:186
(anonymous) @ uc92/:582
(anonymous) @ uc92/:582
jC @ uc92/:582
nC @ uc92/:587
hD @ uc92/:606
jD @ uc92/:608
setTimeout
Sc @ uc92/:201
kD @ uc92/:611
io @ uc92/:762
(anonymous) @ uc92/:766
c @ uc92/:764
(anonymous) @ uc92/:766
(anonymous) @ uc92/:766
(anonymous) @ uc92/:768Understand this error
buy-tickets.js?ver=1.10.10:2282 Response status: 200
buy-tickets.js?ver=1.10.10:2289 API response: {event: {…}, event_dates: Array(1), event_vouchers: '[{"voucher_code":"95ad5436689e79a12ca74de21e2bec57…scount":97,"voucher_discount_type":"percentage"}]'}
buy-tickets.js?ver=1.10.10:2297 Found event date: {event_id: 358, event_date_id: 2327, event_datetime: '2025-09-04 16:30:00', showtime_status: 'active', cron_check: 0, …}
buy-tickets.js?ver=1.10.10:2345 Formatted date string: Thursday 4 September 2025 at 16:30
buy-tickets.js?ver=1.10.10:2384 Refused to connect to 'https://boxoffice.fossettscircus.com/api/addons' because it violates the following Content Security Policy directive: "connect-src 'self' https://api.stripe.com https://r.stripe.com https://m.stripe.network https://m.stripe.com".
fetchEventData @ buy-tickets.js?ver=1.10.10:2384
await in fetchEventData
(anonymous) @ buy-tickets.js?ver=1.10.10:616Understand this error
buy-tickets.js?ver=1.10.10:2384 Fetch API cannot load https://boxoffice.fossettscircus.com/api/addons. Refused to connect because it violates the document's Content Security Policy.
# What the errors mean (and the fixes)
1) `Refused to load the stylesheet … font-awesome … violates "style-src 'self' 'unsafe-inline'"`
– **Why:** Your CSP only allows styles from your own domain (`'self'`) and inline styles. External CSS from cdnjs is blocked.
– **Fix:** Allow the CDN host in `style-src` (and also in `style-src-elem` if you use it) and allow the font host in `font-src`.
– Add: `https://cdnjs.cloudflare.com` (or the exact host: `https://cdnjs.cloudflare.com/ajax/libs/…`)
– If you use Google Fonts, see #2.
2) `Refused to load the stylesheet … fonts.googleapis.com … violates "style-src …"`
– **Why:** Same as above, but for Google Fonts’ CSS.
– **Fix:**
– In `style-src` (and `style-src-elem`): add `https://fonts.googleapis.com`
– In `font-src`: add `https://fonts.gstatic.com`
3) `Uncaught SyntaxError: Identifier 'stripe' has already been declared`
– **Why:** You’re declaring `stripe` twice (e.g., `const stripe = Stripe(…)`)—likely once in `buy-tickets.php` inline and again in `buy-tickets.js`.
– **Fix options (pick one):**
– Remove one declaration so it’s created **once**.
– Or use a guard:
<script>
if (!window.stripe) window.stripe = Stripe('pk_live_xxx', { apiVersion: '2024-06-20' });
</script>– Or rename the second variable.
4) `Refused to load the script 'https://sibautomation.com/sa.js?…' … violates "script-src …"`
– **Why:** Your CSP `script-src` doesn’t include `sibautomation.com` (Brevo/Sendinblue).
– **Fix:** Add `https://sibautomation.com` to `script-src`. If you don’t need it on this page, remove the tag to avoid the error.
5) `Refused to load the script 'https://connect.facebook.net/en_US/fbevents.js' … violates "script-src …"`
– **Why:** Facebook Pixel not allowed by `script-src`.
– **Fix:** Add `https://connect.facebook.net` to `script-src` **and** (if images beacons fire) add `https://www.facebook.com` to `img-src`. If you don’t want Pixel here, remove the tag.
6) `Refused to connect to 'https://boxoffice.fossettscircus.com/api/addons' … violates "connect-src …"`
– **Why:** Your fetch/XHR to `boxoffice.fossettscircus.com` is blocked by `connect-src`.
– **Fix:** Add `https://boxoffice.fossettscircus.com` to `connect-src`. (Or proxy that request through your own domain so it stays under `'self'`.)
7) “Note that ‘style-src-elem’ was not explicitly set, so ‘style-src’ is used as a fallback.”
– **Why:** That’s just Chrome telling you it’s using `style-src` for “.
– **Fix (optional but cleaner):** Explicitly set `style-src-elem` (same hosts as `style-src`) for clarity.
8) Earlier message you saw: **“The CSP directive ‘frame-ancestors’ is ignored when delivered via a “ element.”**
– **Why:** `frame-ancestors` only works in **HTTP headers**, not in “.
– **Fix:** Serve your CSP as an HTTP response header (Apache/Nginx), not a meta tag.
# Drop‑in CSP header (Apache example)
Tight but functional for your page (Stripe, Google Pay, Google Fonts, cdnjs, FB Pixel, Brevo, your box office API). Adjust domains to exactly what you use.
<IfModule mod_headers.c>
Header always set Content-Security-Policy "
default-src 'self';
script-src 'self' 'unsafe-inline'
https://js.stripe.com
https://pay.google.com
https://www.gstatic.com https://*.gstatic.com
https://connect.facebook.net
https://sibautomation.com;
style-src 'self' 'unsafe-inline'
https://fonts.googleapis.com
https://cdnjs.cloudflare.com;
style-src-elem 'self' 'unsafe-inline'
https://fonts.googleapis.com
https://cdnjs.cloudflare.com;
font-src 'self' data:
https://fonts.gstatic.com
https://cdnjs.cloudflare.com;
img-src 'self' data: blob:
https://*.stripe.com https://js.stripe.com
https://www.facebook.com https://connect.facebook.net
https://*.google.com https://*.gstatic.com;
connect-src 'self'
https://api.stripe.com https://r.stripe.com https://m.stripe.network https://m.stripe.com
https://boxoffice.fossettscircus.com;
frame-src 'self' https://js.stripe.com https://hooks.stripe.com https://pay.google.com;
frame-ancestors 'self' https://pay.google.com https://js.stripe.com;
base-uri 'self';
form-action 'self' https://hooks.stripe.com;
"
</IfModule>**Notes:**
– If you use **cdnjs** for Font Awesome, the host is `https://cdnjs.cloudflare.com` (already included above). If you load fonts from there, keep it in `font-src` too.
– If you don’t actually need Pixel/Brevo on this page, **remove those scripts** and you can keep the CSP stricter (don’t add their domains).
– Consider adding a **`report-uri`** or **`report-to`** endpoint to capture future CSP violations without breaking the page.
# Quick checklist for you
– [ ] Decide which external resources you truly need on **this** page.
– [ ] Update the **HTTP header** CSP (not “) with only those hosts.
– [ ] Add `fonts.googleapis.com` (style) + `fonts.gstatic.com` (font).
– [ ] Add `cdnjs.cloudflare.com` if using Font Awesome via cdnjs.
– [ ] Add `connect.facebook.net` / `sibautomation.com` only if required.
– [ ] Add `boxoffice.fossettscircus.com` to `connect-src` for your fetch.
– [ ] Fix the **duplicate `stripe` declaration** (declare once).
If you paste your current `.htaccess`/vhost CSP and the exact `/` tags you’re using, I’ll tailor the exact policy lines so it’s both secure and silent.