SUPPORT.TWILIO.COM END OF LIFE NOTICE: This site, support.twilio.com, is scheduled to go End of Life on February 27, 2024. All Twilio Support content has been migrated to help.twilio.com, where you can continue to find helpful Support articles, API docs, and Twilio blog content, and escalate your issues to our Support team. We encourage you to update your bookmarks and begin using the new site today for all your Twilio Support needs.

Does Analytics.js Support Strict CSP Nonces for Destination Scripts?

Question

Does Segment Analytics.js support strict Content Security Policy (CSP) with per-request nonces, and are nonces propagated to scripts loaded by destinations?

 

Product

Segment

 

Environment

Segment Console

 

Answer

Analytics.js supports the use of strict Content Security Policy (CSP) with per-request nonces. When a nonce is included on the initial Analytics.js script tag, the same nonce is propagated to all scripts dynamically loaded by Analytics.js, including bundles and device-mode destination SDKs. In addition to allowing the main analytics.min.js script, your CSP should cover the following paths and endpoints:

The nonce attribute on your Segment script tag must match the value specified in your CSP header. Nonces are propagated to the bundles and destination scripts that Analytics.js loads from cdn.segment.com at runtime. As long as your initial script tag includes the correct nonce, subsequent scripts injected by Analytics.js will also use the same nonce, ensuring compatibility with your strict CSP.

Have more questions? Submit a request
We can’t wait to see what you build.
Powered by Zendesk