[Docs] Incorrect CSP connect-src configuration in Matomo tracking example

[StrangeRanger]

Lychee version

N/A

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.5

Detailed description of the problem

Description

The External Tracking documentation contains an incorrect Content Security Policy (CSP) configuration for Matomo Analytics.

Under Allow loading tracking script, the documentation recommends:

SECURITY_HEADER_SCRIPT_SRC_ALLOW=https://analytics.example.com/matomo.js
SECURITY_HEADER_CSP_CONNECT_SRC=https://analytics.example.com/matomo.js

However, the SECURITY_HEADER_CSP_CONNECT_SRC variable points to matomo.js rather than the actual Matomo tracking endpoint, matomo.php.

Problem

Matomo uses two separate endpoints:

• matomo.js: Loads the JavaScript tracking library and is governed by the CSP script-src directive.
• matomo.php: Receives tracking requests and is governed by the CSP connect-src directive.

Because the documented connect-src configuration only permits matomo.js, browsers enforcing this policy may block requests to matomo.php.

This can result in Matomo's JavaScript loading successfully while page views and other tracking events are not recorded.

Suggested Fix

Update the documented configuration to:

SECURITY_HEADER_SCRIPT_SRC_ALLOW=https://analytics.example.com/matomo.js
SECURITY_HEADER_CSP_CONNECT_SRC=https://analytics.example.com

Alternatively, for a more restrictive CSP:

SECURITY_HEADER_SCRIPT_SRC_ALLOW=https://analytics.example.com/matomo.js
SECURITY_HEADER_CSP_CONNECT_SRC=https://analytics.example.com/matomo.php

Using the origin for connect-src is generally more flexible, while specifying matomo.php limits connections to the tracking endpoint.

Steps to reproduce the issue

N/A

Diagnostics [REQUIRED]

N/A

Browser & System [REQUIRED]

N/A

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[CaptainAni187]

You're right. connect-src should allow the endpoint the tracker sends data to, not the script file, so pointing it at matomo.js doesn't help. Allowing the Matomo origin covers it:

SECURITY_HEADER_SCRIPT_SRC_ALLOW=https://analytics.example.com/matomo.js
SECURITY_HEADER_CSP_CONNECT_SRC=https://analytics.example.com

(or https://analytics.example.com/matomo.php if you'd rather keep it to the exact endpoint).

The docs page lives in the website repo, LycheeOrg/LycheeOrg.github.io, at src/content/docs/docs/administration/external-tracking.md, so a small PR there with this fix would be the quickest way to get it corrected.

[StrangeRanger]

I'll go ahead and make a PR, then.

[StrangeRanger]

Alright, I've made a PR at LycheeOrg/LycheeOrg.github.io#352. Please let me know if this issue should be closed, or if I should wait till the PR is approved and merged.

[CaptainAni187]

Nice, thanks for opening the PR! I'd keep the discussion open until it's merged, so anyone reading the current docs page can still find the corrected setting here. If the answer was useful, you can mark it as the answer in the meantime, and the discussion can be closed once the PR lands.

[ildyria]

Merged! deployment will happen later tonight. <3

PS: thank you for opening the PR. :)