Hi,
I can see that there’s a nice and clean way to generate nonce for gtm. Is there a way to add the nonce to the DOM without installing GTM container? I’d like to avoid using unsafe-inline for my scripts.
AI-generated summary
A discussion is underway about server-side generated Content Security Policy (CSP) nonces for non-Google Tag Manager (GTM) scripts. kuba.bomba inquired about adding a nonce to the DOM without installing a GTM container to avoid using unsafe-inline for scripts. pmusaraj marked the topic as #pr-welcome, suggesting that including a nonce regardless of GTM installation is technically possible.
j127 noted that a CSP nonce would also be helpful in resolving a Cloudflare issue, where Super Bot Fight Mode injects inline scripts. sam mentioned that the splash screen implementation already utilizes CSP nonces and adapting this for GTM or Super Bot might be feasible.
However, kuba.bomba reported that their unsafe-inline recently stopped working due to a hash or nonce value being present in the source list, potentially caused by the splash screen’s nonce. This resulted in the loss of a month’s worth of web analytics data.
Good question, technically I don’t see a reason why we shouldn’t include the nonce regardless of whether GTM is installed.
Marking this as pr-welcome.
A CSP nonce would be useful to get around a Cloudflare problem as well.
Cloudflare’s Super Bot Fight Mode injects inline scripts and the docs mention using a nonce:
The error I’m getting on my site is: “Refused to execute a script because its hash, its nonce, or ‘unsafe-inline’ does not appear in the script-src directive of the Content Security Policy.”
Our splash screen implementation already uses CSP nonces, @Johani built it.
Getting something like that to work for GTM or superbot is probably fairly workable.
Actually… my unsafe-inline just stopped working. Did you introduce some breaking changes? Console reports:
Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list
The thing is that I didn’t change anything. Did the splash screen’s nonce break it? 
I lost a month of web analytics data because of that…