How to make Google Tag Manager and Content-Security-Policy coexist?
<p>The <a href="https://content-security-policy.com/" rel="noreferrer">Content-Security-Policy (CSP)</a> header aims to protect your application against malicious resource injection in your web apps. To make it simple, you provide a whitelist of allowed domain origins for all your images, scripts, styles and so on.</p>

<p>Meanwhile, Marketing team is using <a href="https://www.google.com/analytics/tag-manager/" rel="noreferrer">Google Tag Manager (GTM)</a> to manage tags. The principle is to gather information from a page, send them to GTM and use those data as variables to generate tags, a mix of templated JS/HTML and those variables.</p>

<p>The problem is that most of those tags contain javascript, for sending very specific data to trackers, ad servers or whatever partners. Let's assume my marketing team is aware of security risks and will not include malicious script. </p>

<p>Is there a way to know which domains are imported by GTM so they can be automatically added on my CSP?</p>