This is how to generate a hash for use in a script-src
CSP header
When https://www.googletagmanager.com/gtm.js?id=GTM-KSNK298 loads an inline script, it doesn't correctly include a nonce on the inline script, and so we get a CSP violation and the inline script cannot run.
Hence we need to generate a hash of the inline script and include it in our script-src
CSP header.
- Set a breakpoint in https://www.googletagmanager.com/gtm.js?id=GTM-KSNK298, before the line
a.insertBefore(g, null));
- examine the contents of
g
at the console, and save the contents inside the<script ...>
tag (but not the script tag itself) toinline.js