我的 jekyll 应用程序中有一个谷歌分析脚本,它突然停止捕获访问者信息。我已确定散列已弃用,并已包含以下错误消息:
<script async src="https://www.googletagmanager.com/gtag/js?id=XYZ" integrity="sha384-MY HASH" crossorigin="anonymous"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js',new Date());
gtag('config','UA-144775756-1');
</script>
在 Firefox 开发版中:
None of the “sha384” hashes in the integrity attribute match the content of the subresource.
在 Chrome 中:
GET https://www.googletagmanager.com/gtag/js?id=XYZ net::ERR_BLOCKED_BY_CLIENT
出于安全原因,我无法删除完整性哈希,我需要这些分析。
我曾尝试通过 https://www.srihash.org/ 更改完整性哈希,但不幸的是没有真正改变。
我尝试添加 CSP 元标记:
<meta http-equiv="Content-security-policy" content="default-src 'self' https://www.googletagmanager.com">
然而,这会导致与上述相同的错误以及这些错误:
Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self' https://www.googletagmanager.com". Either the 'unsafe-inline' keyword,a hash ('sha256-UVGwFlokk48rx16gP58wsQf8mf94VqVbcJorUyG9iug='),or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set,so 'default-src' is used as a fallback.
Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self' https://www.googletagmanager.com". Either the 'unsafe-inline' keyword,a hash ('sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog='),or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers,style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present. Note also that 'style-src' was not explicitly set,so 'default-src' is used as a fallback.
更新:
我能够使用 this solution 修复 CSP 错误,但 sha384
哈希的原始问题仍然存在。