fix(csp): allow GA via Tag Manager (#10715)

mdn · Mar 15, 2024 · e8ec3d3 · e8ec3d3
1 parent 58ac9dd
commit e8ec3d3
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/libs/constants/index.js b/libs/constants/index.js
@@ -64,7 +64,10 @@ export const CSP_SCRIPT_SRC_VALUES = [
   "'report-sample'",
   "'self'",
 
+  // UA.
   "www.google-analytics.com/analytics.js",
+  // GA4.
+  "https://www.googletagmanager.com/gtag/js",
 
   "assets.codepen.io",
   "production-assets.codepen.io",
@@ -104,7 +107,12 @@ export const CSP_DIRECTIVES = {
     "updates.developer.allizom.org",
     "updates.developer.mozilla.org",
 
+    // UA.
     "www.google-analytics.com",
+    // GA4.
+    "https://*.google-analytics.com",
+    "https://*.googletagmanager.com",
+
     "stats.g.doubleclick.net",
     "https://api.stripe.com",
   ],
@@ -146,7 +154,13 @@ export const CSP_DIRECTIVES = {
     "wikipedia.org",
     "upload.wikimedia.org",
 
+    // UA.
     "www.google-analytics.com",
+
+    // GA4.
+    "https://*.google-analytics.com",
+    "https://*.googletagmanager.com",
+
     "www.gstatic.com",
   ],
   "manifest-src": ["'self'"],