Improve CSP handling for google analytics script
@aomarks is already working on this.
Since Sep 30, 2021.
- Dominant language
- TypeScript
- Stars
- 142
- Forks
- 230
- PR merge metrics
- No merged PRs in 30d
Description
We currently have a hard-coded sha256 hash to allow the inline google analytics script to run.
If we ever updated that script, or updated our Google Analytics ID, this could easily get out of sync.
We should automate generation of this hash just like we do for other inline scripts. The reason we can't do this with the exact same method is that the Google Analytics ID needs to be baked into the source.
It would also be a good idea to register another Google Analytics account to use for dev and testing, because the main reason I missed this in my initial set of CSP PRs was that the Google Analytics script is only present at all in the main production build. (The reason for registering another account would be to avoid polluting our main account with dev/testing page loads).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.