Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Feature Request] Bundle or pull tracker code instead of inlining it #17

Open
yktoo opened this issue May 15, 2023 · 0 comments
Open

[Feature Request] Bundle or pull tracker code instead of inlining it #17

yktoo opened this issue May 15, 2023 · 0 comments

Comments

@yktoo
Copy link

yktoo commented May 15, 2023

Script inlining is generally seen as a security risk and therefore requires special care when using CSP, i.e. 'unsafe-inline', nonces or hashes. The latter two can, however, cause issues with some browsers (particularly Safari), and nonces are a bit problematic to implement because they require the server sending a random number on each request.

We'd prefer loading the tracking script in a secure, reliable way via a script link over inlining:

<script defer async src="https://example.com/piwik.js"></script>

But the Angular library of Piwik PRO has no such option: it always creates a script node in the <head> and sets its text.

I see two solutions to this:

  • Option A: add an option to specify the tracking script URL
  • Option B: bundle the tracking code into the application code. No extra script would then be required.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@yktoo