# After upgrade the content security policy script src for GTM
**URL:** https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326
**Category:** Data & reporting
**Created:** [April 10, 2021, 3:28pm UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326 "2021-04-10T15:28:14Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@honeymoose](https://meta.discourse.org/u/honeymoose)
#### Post date: [April 10, 2021, 3:28pm UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326/1 "2021-04-10T15:28:14Z")
we was updated Discourse @ 2021-04-08.
Then we noticed the content\_security\_policy may have some issue.
GTM for content security policy script src
F12 for console:
This happened updated to newest version of discourse.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [April 10, 2021, 4:35pm UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326/2 "2021-04-10T16:35:08Z")
Can you show us the full CSP header as sent?
---
### Author:  [@honeymoose](https://meta.discourse.org/u/honeymoose)
#### Post date: [April 10, 2021, 5:33pm UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326/3 "2021-04-10T17:33:42Z")
@supermathie
Thank you very much for your quick response.
I tried to load header from Firefox, I am not sure did I do something right.
Please see attachment of the screen.
Changed to Chrome.
In here, maybe you can have more detail for the request.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [April 12, 2021, 5:17pm UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326/4 "2021-04-12T17:17:09Z")
Things must have changed since the original post since it’s now behaving as it should:
```plaintext
○ → curl -I https://www.ossez.com
HTTP/2 200
…
content-security-policy: base-uri 'none'; object-src 'none'; script-src https://www.ossez.com/logs/ https://www.ossez.com/sidekiq/ https://www.ossez.com/mini-profiler-resources/ https://www.ossez.com/assets/ https://www.ossez.com/brotli_asset/ https://www.ossez.com/extra-locales/ https://www.ossez.com/highlight-js/ https://www.ossez.com/javascripts/ https://www.ossez.com/plugins/ https://www.ossez.com/theme-javascripts/ https://www.ossez.com/svg-sprite/ https://www.googletagmanager.com/gtm.js 'nonce-38d2a45e5e933b869e14465772b2c0de' https: https://tagmanager.google.com https://www.googletagmanager.com 'unsafe-inline' https://analytics.ossez.com/matomo.js https://www.ossez.com/cdn-cgi/apps/head/qk5vBDFy7qBIoPy3q8a6LUoKei8.js https://www.googletagmanager.com/gtm.js; worker-src 'self' https://www.ossez.com/assets/ https://www.ossez.com/brotli_asset/ https://www.ossez.com/javascripts/ https://www.ossez.com/plugins/
```
‘unsafe-inline’ is now properly quoted, but is being ignored by Chrome:
> Refused to execute inline script because it violates the following Content Security Policy directive: […] Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.
and Firefox:
> Content Security Policy: Ignoring “‘unsafe-inline’” within script-src or style-src: nonce-source or hash-source specified
since you’ve specified a nonce value in the CSP list: `'nonce-38d2a45e5e933b869e14465772b2c0de'`
I see that you’re behind Cloudflare; please note that you have to disable [various Cloudflare features](https://meta.discourse.org/t/full-site-cdn-acceleration-for-discourse/21467) since by default they will break Discourse.
---
### Author:  [@honeymoose](https://meta.discourse.org/u/honeymoose)
#### Post date: [April 13, 2021, 3:26pm UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326/5 "2021-04-13T15:26:52Z")
Thank you very much.