Piwik pro and Content Security Policy

Data collection and tags
1

Hi,

I am looking for guidance on implementing a Content Security Policy (CSP) while using Piwik Pro.

I’ve reviewed the documentation related to this, and understand that a nonce value must be included in the Piwik Pro script.

My questions are :

-If my Piwik Pro script is executed via Google Tag Manager (GTM), is passing the nonce through the Data Layer the best approach?
-Given that Data Layer values may be exposed, does this present a security concern?
-What are your recommendations for ensuring the security of this process?

To summarize:

  • The Piwik Pro tag is deployed via GTM.
  • I need to securely obtain the nonce value within my GTM-managed script.

Is using the Data Layer to pass the nonce value secure in this context? If it is not advisable, what secure methods would you recommend for transferring the nonce value to the Piwik Pro script?

Thank you for your help !

2

Hi @Flash,

This article explains how you can add the nonce through GTM - Using Google Tag Manager with a Content-Security-Policy - DEV Community

Please let me know if you have any questions.

Have a great day! :slight_smile: