# Content Security Policy (CSP) issue

**URL:** <https://community.piwik.pro/t/content-security-policy-csp-issue/1139>\
**Category:** Data collection and tags\
**Created:** [October 17, 2022, 2:33pm UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139 "2022-10-17T14:33:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jurgendl](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/jurgendl/32/848_2.png) [@jurgendl](https://community.piwik.pro/u/jurgendl)\
**Post date:** [October 17, 2022, 2:33pm UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139/1 "2022-10-17T14:33:02Z")

</div>

I followed the install async from

> **[Install a container (with a tracking code) | Piwik PRO help center](https://help.piwik.pro/support/getting-started/install-a-tracking-code/)**
>
> Piwik PRO uses a container to let you manage tags and consents, and run a tracking code (a JavaScript code) on your web pages. The tracking code collects data about people who visit your site or app. Every time a visitor views a page, the tracking...

```auto
	<script nonce="tzT4D_jxELBN94UD4ta9FyHD" type="text/javascript">/*<![CDATA[*/ 
(function(window, document, dataLayerName, id) {
window[dataLayerName]=window[dataLayerName]||[],window[dataLayerName].push({start:(new Date).getTime(),event:"stg.start"});var scripts=document.getElementsByTagName('script')[0],tags=document.createElement('script');
function stgCreateCookie(a,b,c){var d="";if(c){var e=new Date;e.setTime(e.getTime()+24*c*60*60*1e3),d="; expires="+e.toUTCString()}document.cookie=a+"="+b+d+"; path=/"}
var isStgDebug=(window.location.href.match("stg_debug")||document.cookie.match("stg_debug"))&&!window.location.href.match("stg_disable_debug");stgCreateCookie("stg_debug",isStgDebug?1:"",isStgDebug?14:-1);
var qP=[];dataLayerName!=="dataLayer"&&qP.push("data_layer_name="+dataLayerName),isStgDebug&&qP.push("stg_debug");var qPString=qP.length>0?("?"+qP.join("&")):"";
tags.async=!0,tags.src="https://CLIENT.containers.piwik.pro/"+id+".js"+qPString,scripts.parentNode.insertBefore(tags,scripts);
!function(a,n,i){a[n]=a[n]||{};for(var c=0;c<i.length;c++)!function(i){a[n][i]=a[n][i]||{},a[n][i].api=a[n][i].api||function(){var a=[].slice.call(arguments,0);"string"==typeof a[0]&&window[dataLayerName].push({event:n+"."+i+":"+a[0],parameters:[].slice.call(arguments,1)})}}(i[c])}(window,"ppms",["tm","cm"]);
})(window, document, 'dataLayer', 'IDDDD');
 /*]]>*/</script>

```

I noticed the javascript tag being inserted by this code not having a nonce value

```auto
 <script async="" src="https://CLIENT.containers.piwik.pro/IDDDD.js"></script>

```

and the CSP setup from

> **[Content Security Policy (CSP)](https://developers.piwik.pro/en/latest/tag_manager/content_security_policy.html#example-content-security-policy-definition)**
>
> Introduction: Specifying Content Security Policy is a common way to secure web applications. This mechanism allows specifying which scripts and styles can execute on page. It can be done either by ...

my CSP header (formatted for easy reading):

```auto
default-src 'self';
script-src 'self' CLIENT.containers.piwik.pro CLIENT.piwik.pro 'nonce-NONCEVALUE';
style-src 'self' 'unsafe-inline' CLIENT.containers.piwik.pro CLIENT.piwik.pro;
img-src 'self' data: CLIENT.containers.piwik.pro CLIENT.piwik.pro;
connect-src 'self' CLIENT.containers.piwik.pro CLIENT.piwik.pro;
font-src 'self' CLIENT.containers.piwik.pro CLIENT.piwik.pro

```

and I get multiple javascript errors (in each browser) like this:

```auto
IDDDD.js:8 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' ugent.containers.piwik.pro ugent.piwik.pro 'nonce-NONCEVALUE'". Either the 'unsafe-inline' keyword, a hash ('sha256-nxo4EskUoTDeZxPZmw/HiB5b6h9wdgxpDuYxXVQ9iPQ='), or a nonce ('nonce-...') is required to enable inline execution.
|renderScriptElement|@|IDDDD.js:8|
|---|---|---|
|renderNode|@|IDDDD.js:8|
|render|@|IDDDD.js:8|
|(anonymous)|@|IDDDD.js:8|
|consume|@|IDDDD.js:8|
|consume|@|IDDDD.js:8|
|processEventsPushedBeforeOverride|@|IDDDD.js:8|
|override|@|IDDDD.js:8|
|init|@|IDDDD.js:8|
|(anonymous)|@|IDDDD.js:8|
|(anonymous)|@|IDDDD.js:8|
|(anonymous)|@|IDDDD.js:8|

```

it used to work but starting from around 12 october 2022, stats collection dropped to zero

---

<div class="post-metadata">

**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\
**Post date:** [October 17, 2022, 2:52pm UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139/2 "2022-10-17T14:52:45Z")

</div>

Hi. Could you share website URL?

---

<div class="post-metadata">

**Author:** ![jurgendl](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/jurgendl/32/848_2.png) [@jurgendl](https://community.piwik.pro/u/jurgendl)\
**Post date:** [October 17, 2022, 3:07pm UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139/3 "2022-10-17T15:07:52Z")

</div>

the production url is

> **[Welcome in the Research Explorer, the place to discover Ghent University...](https://research.ugent.be/web/home/en)**
>
> Welcome in the Research Explorer, the place to discover Ghent University research.

but the setup is different, I’ve tried a lot of things and the most lean setup is the one I’ve posted above and is running on my machine

---

<div class="post-metadata">

**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\
**Post date:** [October 18, 2022, 8:49am UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139/4 "2022-10-18T08:49:17Z")

</div>

Thanks for the report. The issue is on our and and should be fixed early next week, most likely on Monday.

---

<div class="post-metadata">

**Author:** ![jurgendl](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/jurgendl/32/848_2.png) [@jurgendl](https://community.piwik.pro/u/jurgendl)\
**Post date:** [October 27, 2022, 1:31pm UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139/5 "2022-10-27T13:31:33Z")

</div>

issue has been resolved by Piwik

---

<div class="post-metadata">

**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\
**Post date:** [October 27, 2022, 2:43pm UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139/6 "2022-10-27T14:43:27Z")

</div>

Thanks for confirming!

---

<div class="post-metadata">

**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\
**Post date:** [July 26, 2023, 9:37am UTC](https://community.piwik.pro/t/content-security-policy-csp-issue/1139/7 "2023-07-26T09:37:45Z")

</div>

Split this topic on July 26, 2023, 9:37am UTC

A post was split to a new topic: [Problem with CSP](https://community.piwik.pro/t/problem-with-csp/2645)