Endlessly 'Loading'

[3DPixel]

Describe the problem/question

I've just installed the latest version of PasteBin (2.0.4)
When I paste the generated URL after clicking 'Create', I get 'Loading' and it never changes.

Did you use the FAQ section?

• Yes, I have read the FAQ and I found no solution/answer there.

What you did?

1. Go to https://itdoc.cloud/secnote
2. Create a note and copy the URL
3. In another browser/private browser, paste the URL.

What happens

When you visit the generated URL, it just shows 'Loading' and never gets past it.

Incidentally, I pasted this into a private browser session then when it didn't work, closed the browser. When I reopened it back into a private session (in the same browser) and went to the root (itdoc.cloud/secnote), it was still showing the 'Loading' screen.
Private browser sessions are not supposed to 'remember' anything including active sessions right?

In the browser console, I see this:
None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/jquery-3.7.1.js.pagespeed.jm.T-7rMj-j57.js”. The computed hash is “QW79O7VuqWveXQZmuUouaLh9iN4cgx/IkYIONKgmBDKdRrnB+goG+zEZXvdIcuWgFI+CYBlZKx06u0X+FkCs/A==”. secnote

None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/base-x-5.0.1.js.pagespeed.jm.dCjvvMEl8v.js”. The computed hash is “8/75H1xhuwUQ2hnfVK6M9aTrJVV46o04vHtMFmNEYbt/3o6MoSD1IPuzG2DY6xCIb9EaF9uM4+SZd2m2XFoShw==”. secnote

None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/prettify.js,q2.0.4.pagespeed.jm.6h2usue4w-.js”. The computed hash is “LucxzOFAHGUN7Scu/crFtfQwdk1aW09uXZZnAyiCVE+W/DHE2VOymEeGgRspcSMf9C4QXyqCpSegvGgi1wZJpg==”. secnote

None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/legacy.js,q2.0.4.pagespeed.jm.1jR6I7gked.js”. The computed hash is “JdX6GiptYWKO5tkAPPpEvgVDT0vPap1xXAUy1GaTJ90vzf+pCZ64F1TIMXETHf3F4UcX2RcQn1HUKHJ1I3FgQQ==”. secnote

None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/showdown-2.1.0.js.pagespeed.jm.qtApUOm5jI.js”. The computed hash is “iX0iH4LsUbetR/nHWqfCWc6XLHPwZNHXAH5GRG74vLfx57raZgS9qPZEoMOhczN2/jUTDb1fYxPqCNrB+jQTPw==”. secnote

None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/base-x-5.0.1.js.pagespeed.jm.dCjvvMEl8v.js”. The computed hash is “8/75H1xhuwUQ2hnfVK6M9aTrJVV46o04vHtMFmNEYbt/3o6MoSD1IPuzG2DY6xCIb9EaF9uM4+SZd2m2XFoShw==”. secnote

None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/jquery-3.7.1.js.pagespeed.jm.T-7rMj-j57.js”. The computed hash is “QW79O7VuqWveXQZmuUouaLh9iN4cgx/IkYIONKgmBDKdRrnB+goG+zEZXvdIcuWgFI+CYBlZKx06u0X+FkCs/A==”. secnote

None of the “sha512” hashes in the integrity attribute match the content of the subresource at “https://itdoc.cloud/secnote/js/prettify.js,q2.0.4.pagespeed.jm.6h2usue4w-.js”. The computed hash is “LucxzOFAHGUN7Scu/crFtfQwdk1aW09uXZZnAyiCVE+W/DHE2VOymEeGgRspcSMf9C4QXyqCpSegvGgi1wZJpg==”. secnote

What should happen

Visiting the generated URL should show the content of the source note.

Additional information

I'm using a shared hosting provider.
I'm running PHP 8.2
I'm NOT behind a Cloudflare firewall (so this article doesn't help https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-to-make-privatebin-work-when-using-cloudflare-for-ddos-protection)

I have not changed any JS files so this article doesn't help https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-to-make-privatebin-work-when-i-have-changed-some-javascript-files

Server address

https://itdoc.cloud/secnote

Server OS

Linux

Webserver

NGINX

PrivateBin version

2.0.4

Browser and version

Brave, Chrome, Firefox

Local operating system and version

Windows 10

Issue reproducibility

No, I cannot reproduce it on https://privatebin.net.

[elrido]

Have a look at the FAQ section on Cloudflare - It seems from the errors that your "pagespeed" service is breaking the SRI hashes. You either need to disable that service for the privatebin path (/secnote) or update all the SRI hashes accordingly for PrivateBin to function correctly. If you are not aware of using this function or service, please check with your hoster on how to configure this.

[3DPixel]

This is NOT the answer as per the details in the original post.

[elrido]

The errors leave no doubt about the cause of the issue. Something on your setup manipulates the projects JS files, breaking the SRI hash integrity, hence the application refuses to run to protect users from potentially maliciously injected code.

Either you need to vet these changes and if you find them to be benign, opt in to them by regenerating the SRI hashes for your versions of the files and updating them in your configuration file (see the development wiki on how to do that), or you find and disable whatever service is manipulating these resources.

Things like cloudflare do this with the intent of speeding up the download of these resources, but they don't update the SRI in the resources that load them, therefore breaking the protection. Yours may not be cloudflare, but that is still the same issue and the solutions will be similar if not the same (turn it off).

[rugk]

Just for a record @3DPixel what do you use for hosting. Thing is, you apparently actually seem to be behind Cloudflare. See the server headers: