How to add nonce for CSP? gtm4wp_get_the_gtm_tag filter is deprecated.

[gettonet]

Hello,

given the fact gtm4wp_get_the_gtm_tag filter is deprecated, we cannot add nonce to gtm4wp scripts and include in website Content Security Policy.
Why is this filter deprecated, do you plan to get it back in future releases, or do you recommend some other way of adding the gtm4wp scripts to CSP, apart from creating a hash for every single (dynamic) script?

[duracelltomi]

This filter was removed because it introduced some security risks.

If you want to alter the container code in any way, you should turn off the container code in plugin options and add your own container code using the GTM4WP_WPACTION_AFTER_CONTAINER_CODE / gtm4wp_after_container_code filter which fires regardless of whether container code is turned on or off in plugin settings.

Just make sure to output the full header script.

[gettonet]

Datalayer script is making it impossible to add to CSP as hash, as it is dynamically created and it's different on every page:

<script data-cfasync="false" data-pagespeed-no-defer' . ( $has_html5_support ? ' type="text/javascript"' : '' ) . ( $add_cookiebot_ignore ? ' data-cookieconsent="ignore"' : '' ) . '>';

	if ( '' !== $gtm4wp_options[ GTM4WP_OPTION_GTM_CODE ] ) {
		$gtm4wp_datalayer_data = array();
		$gtm4wp_datalayer_data = (array) apply_filters( GTM4WP_WPFILTER_COMPILE_DATALAYER, $gtm4wp_datalayer_data );

		echo '
	var dataLayer_content = ' . wp_json_encode( $gtm4wp_datalayer_data, JSON_UNESCAPED_UNICODE | JSON_NUMERIC_CHECK ) . ';';

		echo '
	' . esc_js( $gtm4wp_datalayer_name ) . '.push( dataLayer_content );';
	}

	echo '
</script>';

It is not the container itself, as it can be added to CSP as hash.
But what to do with datalayer script?
Wouldn't it be worth considering adding a filter for nonce?

[duracelltomi]

I can of course.

What about adding a filter like gtm4wp_get_csp_nonce and what is returned is added to the <script> tag?

[gettonet]

That would be great!

[gettonet]

I tried to help, so created a pull request here: #352

[duracelltomi]

Please review this branch: 7faf339

[gettonet]

Looking good @duracelltomi ! Thank you for your effort, this is indeed an improvement and a huge help to anyone who's using your plugin and dealing with CSP setup.

[gettonet]

@duracelltomi what's the status, would you like to release this update soon?

[duracelltomi]

I'm just finishing my vacation time, will do the release next week

[gettonet]

@duracelltomi just wanted to follow up, will the release be public soon?

[duracelltomi]

If nothing extreme happens, tomorrow.

[gettonet]

Something extreme must have happened! :) @duracelltomi

[duracelltomi]

Indeed, however 1.21 beta1 is now out, you can test it:
https://github.com/duracelltomi/gtm4wp/releases/tag/1.21.beta1