Add support for nonce in matomo scripts when CSP module is enabled

Created on 2 June 2025, about 1 month ago

Problem/Motivation

Drupal offers the Content Security Policy module to easily configure CSP for a site. Currently, the script tags generated for the matomo and matomo_tagmanager modules require "unsafe-inline" to allow the scripts to work.

With CSP, it is recommended to add scripts to a page with nonce:

The recommended way to do this is with a nonce, which should be an unguessable, random value that the server generates individually for each response. Supply the nonce value in the Content- Security-Policy script-src directive.

The CSP module offers a helper service now to support nonces Add helper for safely appending nonce/hash sources Fixed .

Proposed resolution

Check for the CSP module and add a nonce to the script tags inserted in the page.

Remaining tasks

Write a patch
Review
Commit

User interface changes

None

API changes

None

Data model changes

None

Feature request
Status

Active

Version

1.0

Component

Code

Created by

🇳🇱Netherlands seanB Netherlands

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024