Content Security Policy

Two directives let the script load from fiveb.ar and send its counts back.

If your site sends a Content Security Policy, in a Content-Security-Policy header or a <meta http-equiv="Content-Security-Policy"> tag, it has to let the script load from fiveb.ar and send its counts back there. The installation checker reads your site’s policy and says whether it does, and what to change if not. Through a proxy, 'self' is enough.

The two directives

Add https://fiveb.ar to two directives:

• script-src, so the script can load. If the policy has script-src-elem, that decides instead, so add it there.
• connect-src, so the script can send. It uses navigator.sendBeacon(), falling back to fetch(), and connect-src governs both.

script-src 'self' https://fiveb.ar; connect-src 'self' https://fiveb.ar

The script runs no inline code and evaluates no strings, so it needs neither 'unsafe-inline' nor 'unsafe-eval'. A Content-Security-Policy-Report-Only header blocks nothing but reports what it would, so allow fiveb.ar there too before you enforce it.

Policies that rely on default-src

A policy without one of those directives falls back to default-src. Don’t add fiveb.ar there: it would let fiveb.ar in for images, frames and everything else default-src covers. Add the two directives instead, each with what default-src allows plus fiveb.ar:

default-src 'self'; script-src 'self' https://fiveb.ar; connect-src 'self' https://fiveb.ar

Nonces and strict-dynamic

With 'strict-dynamic' in script-src, the browser ignores the addresses listed there and loads only scripts whose tag carries the page’s nonce. Give the tag the same nonce your server gives the page’s other scripts, fresh for each page:

<script async nonce="…" data-domain="example.com" src="https://fiveb.ar/js/tally.js"></script>

A tag added by a tag manager needs no nonce of its own, since 'strict-dynamic' trusts the scripts a trusted script adds. connect-src still needs fiveb.ar.