Improve CSP instructions #20

Activity

1. metmarkosaric commented on Sep 24, 2020

   

   metmarkosaric

   on Sep 24, 2020

   Contributor

   More actions

   Thanks Lou! The reason we don't mention it much is because it doesn't seem to be a big problem for vast majority so didn't want to "clutter" the instructions with edge cases. Only heard from 2 people about CSP out of thousands who've used Plausible. Either most people don't use CSP or those that do are aware that they need to edit their policies for new services they add.

   👎React with 👎5Reacted by Jeremiah Lee, Witt A., JINN/Z, mark-rgmedia and ant0nioli
2. divinerites commented on May 8, 2022

   

   divinerites

   on May 8, 2022

   Contributor

   More actions

   FYI in my plausible-hugo module, there is a dedicated partial for taking care of plausible in your CSP
3. metmarkosaric commented on May 13, 2022

   

   metmarkosaric

   on May 13, 2022

   Contributor

   More actions

   thanks! i've added a note about CSP with a link to this thread on our troubleshoot your integration docs page

   👍React with 👍2Reacted by Jurjen de Vries and satonotdead
4. metmarkosaric

   closed this as completedon May 13, 2022
5. jeremiahlee commented on Nov 21, 2024

   

   jeremiahlee

   on Nov 21, 2024

   More actions

   Adding to the above recommendation to include https://:

   Content-Security-Policy: default-src 'self'; script-src https://plausible.io; connect-src https://plausible.io

   👍React with 👍2Reacted by Johannes Emerich and JL
6. JLT032 commented on Sep 30, 2026

   

   JLT032

   on Sep 30, 2026

   Last edited by JLT032

   More actions

   based on my trials and errors it is recommended to insert a nonce to the script tags generated
   in addition it would be sensible to offer the script tags as two one-liners, since the larger script appears to be multi-line

   example:

   <script nonce="ceea07aa109f2e7b04c388ed0eaec9d223bac7085734fa3efcd6fe3aedcc35d0" async src="https://plausible.io/js/pa-ySovz4M_Z6ZkDkO-1i041.js"></script>
   <script nonce="76440ecf1f22af738c5b4c688a0bc31b61e3bcab108ec4a0f53c369290d5e92a">window.plausible=window.plausible||function(){(plausible.q=plausible.q||[]).push(arguments)},plausible.init=plausible.init||function(i){plausible.o=i||{}}; plausible.init()</script>
   

   this also requires for the script-src to be set as

   script-src 'nonce-ceea07aa109f2e7b04c388ed0eaec9d223bac7085734fa3efcd6fe3aedcc35d0' 'nonce-76440ecf1f22af738c5b4c688a0bc31b61e3bcab108ec4a0f53c369290d5e92a';