Google Tag Manager and Discourse CSP (Content Security Policy)

Documentation Integrations
1

Discourse uses a ‘strict-dynamic’ Content Security Policy, and attaches a nonce to the root GTM script.

That means that, in the vast majority of cases, no extra configuration is required. strict-dynamic will automatically trust any scripts you load via GTM.

If you use GTM Custom JavaScript Variables, then you will need to add 'unsafe-eval' to the content security policy script src site setting. Or alternatively, update your GTM configuration to use ‘Custom Templates’ instead of ‘Custom Variables’.

Last edited by @kelv 2024-12-10T10:11:47Z

Check documentPerform check on document:
13 Likes