CSP config update

oacore · Jun 19, 2023 · 48f4dc7 · 48f4dc7
1 parent 3c456a3
commit 48f4dc7
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/csp.config.js b/csp.config.js
@@ -7,7 +7,7 @@ const PRODUCTION = '*.core.ac.uk core.ac.uk'
 const config = {
   'default-src': [SELF, PRODUCTION],
   // PDF.js worker sadly uses unsafe-eval
-  'script-src': [SELF, '*.google-analytics.com', "'unsafe-eval'"],
+  'script-src': [SELF, '*.google-analytics.com', "'unsafe-eval'", '*.googletagmanager.com'],
   'style-src': [
     SELF,
     'fonts.googleapis.com',
@@ -26,6 +26,7 @@ const config = {
     // https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#transport
     '*.google-analytics.com',
     'stats.g.doubleclick.net',
+    '*.googletagmanager.com',
   ],
   'connect-src': ['*'],
 }