{"action":"created","issue":{"url":"https://api.github.com/repos/davewasmer/ember-cli-rollbar/issues/20","labels_url":"https://api.github.com/repos/davewasmer/ember-cli-rollbar/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/davewasmer/ember-cli-rollbar/issues/20/comments","events_url":"https://api.github.com/repos/davewasmer/ember-cli-rollbar/issues/20/events","html_url":"https://github.com/davewasmer/ember-cli-rollbar/issues/20","id":115461822,"number":20,"title":"Content Security Policy","user":{"login":"mrloop","id":12345,"avatar_url":"https://avatars.githubusercontent.com/u/12345?v=3","gravatar_id":"","url":"https://api.github.com/users/mrloop","html_url":"https://github.com/mrloop","followers_url":"https://api.github.com/users/mrloop/followers","following_url":"https://api.github.com/users/mrloop/following{/other_user}","gists_url":"https://api.github.com/users/mrloop/gists{/gist_id}","starred_url":"https://api.github.com/users/mrloop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrloop/subscriptions","organizations_url":"https://api.github.com/users/mrloop/orgs","repos_url":"https://api.github.com/users/mrloop/repos","events_url":"https://api.github.com/users/mrloop/events{/privacy}","received_events_url":"https://api.github.com/users/mrloop/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-06T08:49:22Z","updated_at":"2015-11-09T22:28:45Z","closed_at":null,"body":"I serve my app with a CSP.  I'd previously been using Airbrake, and thought I'd try rollbar. The main stumbling block was setting up the CSP for inline script in ember-cli-rollbar. I didn't just want to add 'unsafe-inline' so here's what to do\r\n1) Install and configure ember-cli-rollbar (changing configuration will change the script hash)\r\n2) Run ember locally in production environment `ember server -e production`\r\n3) Have a look in chrome console for the error similar to \r\n```\r\nEither the 'unsafe-inline' keyword, a hash ('sha256-Fm2/whhYQWeKGsFHC3/85HdIC/aNhx6cI/mOZSebPSo='), or a nonce ('nonce-...') is required to enable inline execution.\r\n```\r\n4) Copy and paste the 'sha256-....' portion to the relevant server configuration file.\r\n\r\nI add it to my config/environment.js file and generate my CSP headers using https://gist.github.com/mrloop/41ee14daecaf1873cee0\r\n\r\nNow I need to remember to update the hash if the rollbar snippet is updated or my configuration changes.\r\nI'm wondering if there's a better way of loading rollbar which isn't inline.\r\n "},"comment":{"url":"https://api.github.com/repos/davewasmer/ember-cli-rollbar/issues/comments/155219176","html_url":"https://github.com/davewasmer/ember-cli-rollbar/issues/20#issuecomment-155219176","issue_url":"https://api.github.com/repos/davewasmer/ember-cli-rollbar/issues/20","id":155219176,"user":{"login":"davewasmer","id":707213,"avatar_url":"https://avatars.githubusercontent.com/u/707213?v=3","gravatar_id":"","url":"https://api.github.com/users/davewasmer","html_url":"https://github.com/davewasmer","followers_url":"https://api.github.com/users/davewasmer/followers","following_url":"https://api.github.com/users/davewasmer/following{/other_user}","gists_url":"https://api.github.com/users/davewasmer/gists{/gist_id}","starred_url":"https://api.github.com/users/davewasmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davewasmer/subscriptions","organizations_url":"https://api.github.com/users/davewasmer/orgs","repos_url":"https://api.github.com/users/davewasmer/repos","events_url":"https://api.github.com/users/davewasmer/events{/privacy}","received_events_url":"https://api.github.com/users/davewasmer/received_events","type":"User","site_admin":false},"created_at":"2015-11-09T22:28:44Z","updated_at":"2015-11-09T22:28:44Z","body":"Hm - perhaps we could export a script file into the `public/` folder, and use that instead of a inlined tag.\r\n\r\nThe Rollbar snippet is just a loader though, which loads the full Rollbar library via script tag injection. Would that trip the unsafe-inline? If so, I don't see a way around it. If not, then perhaps the approach I mentioned above would work."}}