Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Matomo (Piwik) core JS file fails to execute under new Content Security Policy #14653

Closed
ash-j-f opened this issue Jul 13, 2019 · 3 comments
Closed

Matomo (Piwik) core JS file fails to execute under new Content Security Policy #14653

ash-j-f opened this issue Jul 13, 2019 · 3 comments
Labels
answered For when a question was asked and we referred to forum or answered it.

Comments

@ash-j-f
Copy link

ash-j-f commented Jul 13, 2019 •
edited

UPDATE: This issue was caused by ad blocker plugins in our test browsers blocking Matomo from loading.

Although the Matomo maintainers claim it works under the strictest CSP settings, it fails to execute on all major browsers. The error is "blocked by client" as expected when a script is blocked by CSP.

The Matomo JS file appears to contain a call to create and embed a new script in the DOM, which is one possible thing violating the CSP.

The CSP settings are:

<meta http-equiv=\"Content-Security-Policy\" content=\"frame-src 'self'; script-src 'self' https://www.google.com/ https://www.gstatic.com/ \" />

Matomo's claim to work under strict CSP is here:
https://matomo.org/faq/general/faq_20904/

I have implemented the loading of the JS file in the way they suggest.
@ash-j-f
Copy link
Author

ash-j-f commented Jul 13, 2019 •
edited

Woops wrong repo, sorry. That ticket should have gone on our web application's repo :D If this turns out not to be an issue with our web application config after further investigation I'll open an issue here.

@ash-j-f ash-j-f closed this as completed Jul 13, 2019
@ash-j-f
Copy link
Author

ash-j-f commented Jul 19, 2019 •
edited

In case anyone comes across this ticket, the issue we were having was ad blocker plugins in all the test browsers were blocking Matomo from running, and we were getting errors such as "net::ERR_BLOCKED_BY_CLIENT" in Chrome. Disabling the ad blocker plugins of course allowed Matomo to run, and it now works even with our very strict Content Security Policy enabled.

The plugin we were using was uBlock Origin https://github.com/gorhill/uBlock

@tsteur
Copy link
Member

tsteur commented Jul 19, 2019

👍

@tsteur tsteur added the answered For when a question was asked and we referred to forum or answered it. label Jul 19, 2019
@tsteur tsteur mentioned this issue Aug 1, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
answered For when a question was asked and we referred to forum or answered it.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tsteur @ash-j-f