Google Analytic / Tag Manager with CSP (Content Security Policy)

[codepainting]

I'm having serious problems getting Google Analytic / Tag Manager to work with CSP (Content Security Policy).

So when I set a script-src rule with unsafe-inline (needed for Google Analytics) it throws this error:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com 'sha256-…='". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.

While the explanation is pretty clear (unsafe-inline gets ignored because a hash/nonce is present) there seems to be no way to disable the generation of hashes/nonces in Sveltekit (for all or for specific rules) or at least I am not aware of one.

Any suggestions how I might work around this?

[kamerat]

You can add sveltekit's nonce to your GTM script:

<!-- app.html -->
<script nonce="%svelktekit.nonce%"

[manuganji]

I got a build error on Vercel with this approach.

You can add sveltekit's nonce to your GTM script:

<!-- app.html -->
<script nonce="%svelktekit.nonce%"

Cannot use prerendering if page template contains %sveltekit.nonce%

[kamerat]

Not sure I can help, but if you provide some more context, code or the error that would help.