Hi, I can see that there’s a nice and clean way to generate nonce for gtm. Is there a way to add the nonce to the DOM without installing GTM container? I’d like to avoid using unsafe-inline for my scripts.

A CSP nonce would be useful to get around a Cloudflare problem as well. Cloudflare’s Super Bot Fight Mode injects inline scripts and the docs mention using a nonce: [image] JavaScript Detections Client-side JavaScript challenges that run on every request to identify automated traffic. The error I’m getting on my site is: “Refused to execute a script because its hash, its nonce, or ‘unsafe-inline’ does not appear in the script-src directive of the Content Security Policy.”

Our splash screen implementation already uses CSP nonces, @Johani built it. Getting something like that to work for GTM or superbot is probably fairly workable.

Actually… my unsafe-inline just stopped working. Did you introduce some breaking changes? Console reports: Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list The thing is that I didn’t change anything. Did the splash screen’s nonce break it? :confused: I lost a month of web analytics data because of that…

Is there an option to get server-side generated CSP nonce for non-GTM scripts?

Product Support

pmusaraj (Penar Musaraj) June 23, 2022, 2:19pm 2

Good question, technically I don’t see a reason why we shouldn’t include the nonce regardless of whether GTM is installed.

Marking this as pr-welcome.

Topic		Replies	Views
Google Tag Manager (gtm) script blocked by CSP Data & reporting analytics	4	5745	July 3, 2023
Cant get google tag manager to work Data & reporting analytics	6	1919	September 29, 2023
After upgrade the content security policy script src for GTM Data & reporting	4	1993	April 13, 2021
Add CSP nonce-source support Development	11	4280	November 2, 2018
GTM usage error Data & reporting analytics	6	2214	January 21, 2020

Is there an option to get server-side generated CSP nonce for non-GTM scripts?

Related topics