Google Tag Manager (gtm) script blocked by CSP

Community Building Data & reporting

AI-generated summary

Google Tag Manager (GTM) Script Blocked by CSP

The discussion revolves around resolving an issue where a GTM script is being blocked by a Content Security Policy (CSP).

Initial Issue and Setup
tyf shared a screenshot of the blocked script and provided the GTM script code, which was set up following instructions to add GTM to Discourse. The https://www.googletagmanager.com domain was added to the allowlist.

Potential Solutions
Lilly pointed to a similar topic discussing GTM script loading issues due to CSP, while tyf mentioned following the linked documentation but still experiencing issues. MarkDoerr suggested adding more scripts to the CSP allowlist, handling nonce errors in GTM, and using the wildcard domain https://*.googletagmanager.com instead.

Follow-up and Remaining Issues
tyf thanked MarkDoerr for the suggestions and will reach out to the team to address the nonce handling and additional blocked scripts. Despite allowlisting the GTM domain, CSP-related errors persist in Chrome and Firefox, but not in Brave or Safari.

1

Hi there!

I’m having a hard time figuring out why our GTM script is being blocked by our CSP:

Screenshot 2023-06-30 at 4.16.51 PM
Screenshot 2023-06-30 at 4.16.51 PM1262×786 154 KB

Here’s the script:

<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-XXXX');</script>
<!-- End Google Tag Manager -->

I’m following the instructions here to add GTM to discourse. I’ve removed the GA ID as stated in the article, as well as added https://www.googletagmanager.com to our allowlist.

Any ideas?

2

did you see this topic?

3

Hey @Lilly! I didn’t see that topic in particular, but I did follow the documentation that it links to. I’ve allowlisted https://www.googletagmanager.com :thinking:

5

Hi Ty,

It looks like you have a few scripts being blocked at the moment that you’ll want to add to your CSP:

Screenshot 2023-07-03 at 12.26.00 PM
Screenshot 2023-07-03 at 12.26.00 PM1570×312 78.3 KB

I also see that you’re getting a nonce error in the console. Have you tried configuring GTM to handle those?

One last thing I would try is to add https://*.googletagmanager.com to your allowlist.

7

Thanks a bunch for jumping in here @MarkDoerr!

I’ll need to reach out to the team that handles these scripts and mention nonce handling as well, thanks for pointing these out!

Odd, with either https://www.googletagmanager.com or https://*.googletagmanager.com allowlisted there aren’t any CSP related errors for the GTM script in particular in Brave nor Safari, just Chrome and Firefox.