Adobe Experience Platform Tags
Adobe Experience Platform Tags, previously Adobe Launch, injects inline scripts into your pages on behalf of the extensions and rules you configure. Under a strict CSP those injections are blocked unless they carry a nonce, and the Core extension has a setting for exactly that.
What Adobe Experience Platform Tags gives you
- A nonce configuration on the Core extension: create a data element that references where the nonce appears on the page, point the Core extension at it, and every inline script Tags adds will carry that nonce.
- Nonce support requires asynchronous deployment of the Tags library.
- Adobe-hosted libraries load from
assets.adobedtm.com, so that domain needs allowing inscript-src. Self-hosted libraries only need'self'. 'unsafe-inline'is documented as a fallback, and Adobe is explicit that it is the least secure option.
Sending reports to Report URI
Adobe's guidance does not cover reporting, so add the directive to the policy you serve from your own application. Your URL comes from the Setup page:
Content-Security-Policy-Report-Only: script-src 'self' assets.adobedtm.com 'nonce-{random}'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly
Things to watch for
- The nonce setting only covers scripts that Tags itself injects. Custom code inside a rule that violates your policy is still blocked - the CSP wins.
- The nonce has to change on every page load. If your pages are cached, make sure the nonce is not cached with them.
- Like any tag manager, Tags lets people add scripts to your pages without a code deployment. Script Watch will tell you when the set of scripts on a page changes.
Official documentation
Adobe - Content Security Policy
Start Monitoring with Report URI
Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.
New to Report URI? Create an account and grab your report-uri value from the Setup page.