We are using we_cookie_consent extension in TYPO3 13 with a strict Content Security Policy (CSP) using nonce-based script execution.
TYPO3 correctly adds nonce attributes to rendered scripts.
However, after accepting cookies, Klaro tries to execute dynamically generated inline scripts. These scripts are blocked by CSP because they are created without the required nonce.
Browser console error:
Executing inline script violates the following Content Security Policy directive:
"script-src-elem 'self' 'nonce-xxxxx' ..."
Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.
The error stack points to: klaro.js
The issue happens when Klaro loads services after consent (for example Google Tag Manager).
We are using we_cookie_consent extension in TYPO3 13 with a strict Content Security Policy (CSP) using nonce-based script execution.
TYPO3 correctly adds nonce attributes to rendered scripts.
However, after accepting cookies, Klaro tries to execute dynamically generated inline scripts. These scripts are blocked by CSP because they are created without the required nonce.
Browser console error:
Executing inline script violates the following Content Security Policy directive:
"script-src-elem 'self' 'nonce-xxxxx' ..."
Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.
The error stack points to: klaro.js
The issue happens when Klaro loads services after consent (for example Google Tag Manager).