Strict Content Security Policy
This page allows scripts only with its nonce, and styles only from this site and our CDN. The banner, GA4, and the video below must work exactly as on the other pages, with no CSP errors in the console.
The policy
script-src |
'nonce-…' 'strict-dynamic': the runtime has the nonce and copies it to
every script it activates
|
|---|---|
style-src |
'self' https://cdn.calmconsent.com: the banner's stylesheet, no inline
styles
|
connect-src |
The configuration (this site), receipts (our API), and GA4's endpoints |
frame-src |
https://www.youtube-nocookie.com |