Merge pull request #983 from SkillsFundingAgency/CON-3709_Csp-and-gtm

enable unsafe eval in csp header to test GTM CSP issues.
SkillsFundingAgency · Jul 26, 2021 · b1ec76f · b1ec76f
2 parents 9d6e028 + 258ae4d
commit b1ec76f
Showing 1 changed file with 2 additions and 6 deletions.
diff --git a/src/Employer/Employer.Web/Startup.Configure.cs b/src/Employer/Employer.Web/Startup.Configure.cs
@@ -91,7 +91,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, IOptions
                                     "*.googletagmanager.com/",
                                     "*.postcodeanywhere.co.uk/",
                                     "https://tagmanager.google.com",
-                                    "https://www.tagmanager.google.com/",                                   
+                                    "https://www.tagmanager.google.com/",
                                     "https://*.zdassets.com",
                                     "https://*.zendesk.com",
                                     "wss://*.zendesk.com",
@@ -101,11 +101,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, IOptions
 
                     //Google tag manager uses inline scripts when administering tags
                     s.UnsafeInline();
-
-                    if (env.IsEnvironment(EnvironmentNames.PREPROD))
-                    {
-                        s.UnsafeEval();
-                    }
+                    s.UnsafeEval();
                 })
                 .FontSources(s =>
                     s.Self()