How to add nonce for CSP? gtm4wp_get_the_gtm_tag filter is deprecated. about gtm4wp HOT 13 OPEN

I can of course.

What about adding a filter like gtm4wp_get_csp_nonce and what is returned is added to the <script> tag?

from gtm4wp.

I'm just finishing my vacation time, will do the release next week

from gtm4wp.

Indeed, however 1.21 beta1 is now out, you can test it:
https://github.com/duracelltomi/gtm4wp/releases/tag/1.21.beta1

from gtm4wp.

This filter was removed because it introduced some security risks.

If you want to alter the container code in any way, you should turn off the container code in plugin options and add your own container code using the GTM4WP_WPACTION_AFTER_CONTAINER_CODE / gtm4wp_after_container_code filter which fires regardless of whether container code is turned on or off in plugin settings.

Just make sure to output the full header script.

from gtm4wp.

Datalayer script is making it impossible to add to CSP as hash, as it is dynamically created and it's different on every page:

<script data-cfasync="false" data-pagespeed-no-defer' . ( $has_html5_support ? ' type="text/javascript"' : '' ) . ( $add_cookiebot_ignore ? ' data-cookieconsent="ignore"' : '' ) . '>';

	if ( '' !== $gtm4wp_options[ GTM4WP_OPTION_GTM_CODE ] ) {
		$gtm4wp_datalayer_data = array();
		$gtm4wp_datalayer_data = (array) apply_filters( GTM4WP_WPFILTER_COMPILE_DATALAYER, $gtm4wp_datalayer_data );

		echo '
	var dataLayer_content = ' . wp_json_encode( $gtm4wp_datalayer_data, JSON_UNESCAPED_UNICODE | JSON_NUMERIC_CHECK ) . ';';

		echo '
	' . esc_js( $gtm4wp_datalayer_name ) . '.push( dataLayer_content );';
	}

	echo '
</script>';

It is not the container itself, as it can be added to CSP as hash.
But what to do with datalayer script?
Wouldn't it be worth considering adding a filter for nonce?

from gtm4wp.

That would be great!

from gtm4wp.

I tried to help, so created a pull request here: #352

from gtm4wp.

Please review this branch: 7faf339

from gtm4wp.

Looking good @duracelltomi ! Thank you for your effort, this is indeed an improvement and a huge help to anyone who's using your plugin and dealing with CSP setup.

from gtm4wp.

@duracelltomi what's the status, would you like to release this update soon?

from gtm4wp.

@duracelltomi just wanted to follow up, will the release be public soon?

from gtm4wp.

If nothing extreme happens, tomorrow.

from gtm4wp.

Something extreme must have happened! :) @duracelltomi

from gtm4wp.