[Dashboard] Add Google Tag Manager and PostHog to CSP script sources #7338
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
|
Caution Review failedThe pull request is closed. WalkthroughThe Content Security Policy (CSP) in the dashboard application's configuration was updated to allow scripts from three additional domains: googletagmanager.com, us-assets.i.posthog.com, and edit.framer.com. No other configuration or code changes were made. Changes
Sequence Diagram(s)sequenceDiagram
participant Browser
participant DashboardApp
participant ExternalScriptDomains
Browser->>DashboardApp: Request page
DashboardApp-->>Browser: Responds with CSP including new script-src domains
Browser->>ExternalScriptDomains: Loads scripts from allowed domains (including new ones)
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
How to use the Graphite Merge QueueAdd either label to this PR to merge it via the merge queue:
You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
jnsdls
deleted the
_Dashboard_Add_Google_Tag_Manager_and_PostHog_to_CSP_script_sources
branch
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Bug: CSP Fails to Load Google Tag Manager
The script-src Content Security Policy (CSP) directive allows googletagmanager.com, but Google Tag Manager scripts are typically served from www.googletagmanager.com. Since CSP does not automatically include subdomains, GTM scripts will be blocked by the policy.
apps/dashboard/next.config.ts#L14-L15
js/apps/dashboard/next.config.ts
Lines 14 to 15 in 93b23f6
BugBot free trial expires on June 17, 2025
You have used $0.00 of your $100.00 spend limit so far. Manage your spend limit in the Cursor dashboard.
Was this report helpful? Give feedback by reacting with 👍 or 👎
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #7338 +/- ##
=======================================
Coverage 55.57% 55.58%
=======================================
Files 909 909
Lines 58675 58683 +8
Branches 4160 4158 -2
=======================================
+ Hits 32609 32617 +8
Misses 25959 25959
Partials 107 107
🚀 New features to boost your workflow:
|
size-limit report 📦
|
Update Content Security Policy for additional script sources
Added the following domains to the script-src directive in the Content Security Policy:
This allows scripts from these domains to be loaded and executed on the dashboard.
Summary by CodeRabbit