The discussion revolves around an error in the Content Security Policy (CSP) related to gtag.js. vkalpias reports receiving an error message about an invalid path in the ‘script-src’ directive, specifically mentioning the query component of the URL.
vkalpias reveals that they have a custom theme component including https://www.googletagmanager.com/gtag/js?id=U_XXX... manually, after previously using the built-in Discourse method.
david attributes the issue to a known bug, which was fixed in January. However, the fix hasn’t been backported to the stable branch, so vkalpias will either need to update to tests-passed or wait for the next stable release. The warning can be safely ignored, as browsers will automatically remove the query component of the URL.
Hi,
We are getting this error in our forum (https://forum.playcanvas.com/):
The source list for Content Security Policy directive 'script-src' contains a source with an invalid path: '/gtag/js?id=UA-XXXXXXXX-X'. The query component, including the '?', will be ignored.
We haven’t added that URL in our CSP settings, I think it is added by discourse and the query component is probably not valid in a CSP.
Any idea how to fix it?
How have you configured google tag manager? Are you using the built-in discourse method? Or have you added some custom code to a theme component?
We have a custom theme component that includes https://www.googletagmanager.com/gtag/js?id=U_XXX… manually. We were using the built-in discourse method before but took it out because we needed to add some additional gtag methods called before the analytics are included.
Maybe that CSP was set when we were using the built-in method and now it doesn’t remove it for some reason?
I see. It looks like you’re running into an old bug we had, which was fixed back in January:
This fix hasn’t been backported to the stable branch, so I’m afraid you’ll either have to update to tests-passed, or wait for the next stable release. In the meantime, the warning you see can be safely ignored - the browser will automatically remove the query component of the URL.
Oh I see that makes sense! OK thanks!