Update GA module instructions with CSP

Add instruction to load scripts from GA by modifying csp to a minimal level Signed-off-by: Shiori Yamazaki <syamazaki@twilio.com>
2022-02-25 13:58:04 +02:00
parent fb3dc9d407
commit 052390d527
1 changed files with 13 additions and 0 deletions
@@ -47,6 +47,19 @@ app:
      trackingId: UA-0000000-0
 ```

+4. Update CSP in your `app-config.yaml`:
+
+The following is the minimul content security policy required to load scripts from GA.
+
+```yaml
+backend:
+  csp:
+    connect-src: ["'self'", 'http:', 'https:']
+    # Add these two lines below
+    script-src: ["'self'", "'unsafe-eval'", 'https://www.google-analytics.com']
+    img-src: ["'self'", 'data:', 'https://www.google-analytics.com']
+```
+
 ## Configuration

 In order to be able to analyze usage of your Backstage instance _by plugin_, we