GTM Refused to load the script because it violates the Content Security Policy

[narayanan (Lakshmi Thennarasu)]

Hi,

I’m trying to add new GTM container to discourse. We get

Refused to load the script "https://forums.techsoup.org/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1660101200' because it violates the following Content Security Policy directive: "script-src https://forums.techsoup.org/logs/ https://forums.techsoup.org/sidekiq/ https://forums.techsoup.org/mini-profiler-resources/ https://forums.techsoup.org/assets/ https://forums.techsoup.org/brotli_asset/ https://forums.techsoup.org/extra-locales/ https://forums.techsoup.org/highlight-js/ https://forums.techsoup.org/javascripts/ https://forums.techsoup.org/plugins/ https://forums.techsoup.org/theme-javascripts/ https://forums.techsoup.org/svg-sprite/ https://www.googletagmanager.com/gtm.js 'nonce-0cac1a2cef90863cc692ed7f68c5f4f0'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback"

[neil (Neil Lalonde)]

You need to add new scripts to your content security policy.

Setup Google Tag Manager for Analytics

Support for Google Tag Manager was added today! This howto will show you how to use Google Universal Analytics through Google Tag Manager. After you’re done, the Google Tag Manager API will be running on your Discourse site, so you could in theory send arbitrary events to any service that integrates with Tag Manager. Analytics is only the beginning. For security reasons, all up to date Discourse installs have a Content Security Policy that blocks all non-Discourse scripts. This mea…

@system

For security reasons, all up to date Discourse installs have a Content Security Policy that blocks all non-Discourse scripts. This means that if you add external scripts to your GTM integration, you might have to allowlist their domains in order for the scripts to be allowed to run.

[narayanan (Lakshmi Thennarasu)]

Can you let us know how to integrate with Twitter analytics.