Javascript runs afoul of content security policy

[SKisContent]

On sites that have a HTTP content security policy that is not "unsafe-inline", the analytics Javascript fails to execute. One solution would be to let users specify a string in the settings that is inserted into the

[jcassee]

Thanks for the notice, @SKisContent. What would be required specifically to work around this, can you give a bit more detail?

[SKisContent]

One CSPs option is to add a nonce="xxx" attribute to the section into the rendered page HTML, it would need to do the value substitution on its own.

[harrislapiroff]

Another solution would be to serve up a special view that served the normally inline code as a javascript file instead. (See, for instance, how Matomo/Piwik recommends serving a tracking.js file: https://matomo.org/faq/general/faq_20904/)

[sevdog]

django-csp has a context processor to inject nonce into render context and also can add it to response headers.

If analytics nodes could add a placeholder in their script template to handle this template variable it could be easy to use.