# 升级后 content security policy script src for GTM

**URL:** https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326
**Category:** Data & reporting
**Created:** [2021年四月10日 15:28 UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326 "2021-04-10T15:28:14Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [2021年四月12日 17:17 UTC](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326/4 "2021-04-12T17:17:09Z")

</div>

自从原始帖子发布以来情况一定有所变化，因为现在它的表现已符合预期：

```plaintext
○ → curl -I https://www.ossez.com
HTTP/2 200 
…
content-security-policy: base-uri 'none'; object-src 'none'; script-src https://www.ossez.com/logs/ https://www.ossez.com/sidekiq/ https://www.ossez.com/mini-profiler-resources/ https://www.ossez.com/assets/ https://www.ossez.com/brotli_asset/ https://www.ossez.com/extra-locales/ https://www.ossez.com/highlight-js/ https://www.ossez.com/javascripts/ https://www.ossez.com/plugins/ https://www.ossez.com/theme-javascripts/ https://www.ossez.com/svg-sprite/ https://www.googletagmanager.com/gtm.js 'nonce-38d2a45e5e933b869e14465772b2c0de' https: https://tagmanager.google.com https://www.googletagmanager.com 'unsafe-inline' https://analytics.ossez.com/matomo.js https://www.ossez.com/cdn-cgi/apps/head/qk5vBDFy7qBIoPy3q8a6LUoKei8.js https://www.googletagmanager.com/gtm.js; worker-src 'self' https://www.ossez.com/assets/ https://www.ossez.com/brotli_asset/ https://www.ossez.com/javascripts/ https://www.ossez.com/plugins/

```

`'unsafe-inline'` 现在已被正确加引号，但 Chrome 忽略了它：

> 拒绝执行内联脚本，因为它违反了以下内容安全策略指令：[…] 请注意，如果源列表中存在哈希值或 nonce 值，则 `'unsafe-inline'` 将被忽略。

Firefox 也是如此：

> 内容安全策略：在 script-src 或 style-src 中忽略“‘unsafe-inline’”：已指定 nonce 源或哈希源

这是因为您在 CSP 列表中指定了 nonce 值：`'nonce-38d2a45e5e933b869e14465772b2c0de'`

我看到您使用了 Cloudflare；请注意，您必须禁用 [各种 Cloudflare 功能](https://meta.discourse.org/t/full-site-cdn-acceleration-for-discourse/21467?u=supermathie)，因为默认情况下它们会破坏 Discourse 的正常运行。

---

_[View the full topic](https://meta.discourse.org/t/after-upgrade-the-content-security-policy-script-src-for-gtm/186326)._