{"data":{"id":"magento2-38991","source":"github-pr","sourceRef":"magento/magento2#38991","title":"Google Analytics CSP Error https://region1.analytics.google.com","pr":{"number":38991,"url":"https://github.com/magento/magento2/pull/38991","author":"apedicdev","mergedAt":"2024-11-12T12:33:22Z","mergeCommit":"f643af066cf84ba5fb02742b5698ab6ad83cd46f","headCommit":"a9ac117cf63157d59054eaf0b6328213e03f6f11","baseRef":"2.4-develop","diffSha256":"510a67552f3960081e1479692da32ba6593b5ffef2f1f5d70b74847cd6b6e8bc"},"issues":[{"number":37750,"url":"https://github.com/magento/magento2/issues/37750","title":"Google Analytics CSP Error https://region1.analytics.google.com","labels":["Area: Analytics / Reporting","Component: GoogleAnalytics","Issue: Confirmed","Priority: P2","Progress: done","Reported on 2.4.6-p1","Reproduced on 2.4.x"],"kind":"human"}],"fixedIn":"2.4.8","containingTags":["2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5","2.4.9"],"reportedOn":"2.4.6-p1","codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"clean","2.4.6-p15":"clean","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"conflict","2.4.8-p1":"conflict","2.4.8-p2":"conflict","2.4.8-p3":"conflict","2.4.8-p4":"conflict","2.4.8-p5":"conflict","2.4.9":"conflict"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.6-p14","2.4.6-p15","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10"],"components":["magento/module-google-gtag"],"files":[{"path":"app/code/Magento/GoogleGtag/etc/csp_whitelist.xml","change":"modified","package":"magento/module-google-gtag"}],"stripped":{"tests":[],"docs":[],"outsideCode":[]},"linesChanged":20,"mergeBatched":false,"excluded":null,"sections":{"description":"[Report Only] Refused to connect to 'https://region1.analytics.google.com/g/collect?v=28****** REMOVED ********' because it violates the following Content Security Policy directive: \"connect-src www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.ideal-postcodes.co.uk *.doubleclick.net *.google-analytics.com 'self' 'unsafe-inline'\".","stepsToReproduce":"Enable Google Analytics\nView Website from the EU - Inspect and view CSP console errors.","expectedResult":"No CSP errors","actualResult":"[Report Only] Refused to connect to 'https://region1.analytics.google.com/g/collect?v=28****** REMOVED ********' because it violates the following Content Security Policy directive: \"connect-src www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.ideal-postcodes.co.uk *.doubleclick.net *.google-analytics.com 'self' 'unsafe-inline'\".","source":"issue"},"signatures":[],"labels":{"area":["Analytics / Reporting"],"component":["GoogleAnalytics"],"priority":"P2","severity":null,"reportedOn":["2.4.6-p1"]},"categories":[],"triage":{"model":"@cf/cloudflare/clef","requestHash":"8b80fd3cbe162ff2445eef58efbdaf03c562a77622806c223f20800c087d9844","isBugfix":0.9394,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.9399,"feature":0.0233,"refactor":0.0131,"tests_only":0.0062,"docs_only":0.0074,"dependency":0.0101},"confidence":0.8613},"scope":{"score":0.5885,"probabilities":{"0":0.4835,"1":0.4445,"2":0.072},"confidence":0.1548},"risk":{"score":0.1549,"probabilities":{"0":0.8619,"1":0.1213,"2":0.0168},"confidence":0.6369},"area":{"choice":"frontend","probabilities":{"catalog":0.0203,"checkout":0.0223,"customer":0.0183,"admin":0.0612,"graphql_api":0.0164,"framework":0.0832,"frontend":0.4461,"other":0.3322},"confidence":0.2246},"securityRelevant":0.2809,"reportedVersion":{"choice":"2.4.6-p1","probabilities":{"2.4.0":0.0023,"2.4.0-p1":0.0029,"2.4.1":0.0023,"2.4.1-p1":0.0027,"2.4.2":0.0026,"2.4.2-p1":0.0032,"2.4.2-p2":0.0034,"2.4.3":0.003,"2.4.3-p1":0.0031,"2.4.3-p2":0.0038,"2.4.3-p3":0.0031,"2.4.4":0.0027,"2.4.4-p1":0.003,"2.4.4-p10":0.0038,"2.4.4-p11":0.0038,"2.4.4-p12":0.004,"2.4.4-p13":0.0042,"2.4.4-p14":0.0037,"2.4.4-p15":0.0037,"2.4.4-p16":0.0039,"2.4.4-p17":0.0033,"2.4.4-p18":0.0031,"2.4.4-p2":0.0024,"2.4.4-p3":0.0025,"2.4.4-p4":0.0028,"2.4.4-p5":0.0033,"2.4.4-p6":0.0038,"2.4.4-p7":0.0033,"2.4.4-p8":0.0041,"2.4.4-p9":0.0033,"2.4.5":0.0039,"2.4.5-p1":0.0045,"2.4.5-p10":0.0036,"2.4.5-p11":0.006,"2.4.5-p12":0.0056,"2.4.5-p13":0.0046,"2.4.5-p14":0.0051,"2.4.5-p15":0.0042,"2.4.5-p16":0.0044,"2.4.5-p17":0.0033,"2.4.5-p2":0.0026,"2.4.5-p3":0.0031,"2.4.5-p4":0.0035,"2.4.5-p5":0.0044,"2.4.5-p6":0.0048,"2.4.5-p7":0.0042,"2.4.5-p8":0.0039,"2.4.5-p9":0.0029,"2.4.6":0.031,"2.4.6-p1":0.5852,"2.4.6-p10":0.0099,"2.4.6-p11":0.0104,"2.4.6-p12":0.009,"2.4.6-p13":0.0088,"2.4.6-p14":0.0078,"2.4.6-p15":0.0076,"2.4.6-p2":0.0073,"2.4.6-p3":0.009,"2.4.6-p4":0.0086,"2.4.6-p5":0.0094,"2.4.6-p6":0.0089,"2.4.6-p7":0.009,"2.4.6-p8":0.0066,"2.4.6-p9":0.0055,"2.4.7":0.0052,"2.4.7-p1":0.005,"2.4.7-p10":0.0048,"2.4.7-p2":0.004,"2.4.7-p3":0.0059,"2.4.7-p4":0.0063,"2.4.7-p5":0.0055,"2.4.7-p6":0.006,"2.4.7-p7":0.0042,"2.4.7-p8":0.0035,"2.4.7-p9":0.0031,"2.4.8":0.0039,"2.4.8-p1":0.0043,"2.4.8-p2":0.0051,"2.4.8-p3":0.0065,"2.4.8-p4":0.0064,"2.4.8-p5":0.0065,"2.4.9":0.0052,"unspecified":0.0029},"confidence":0.3376},"backportWorthy":{"score":1.5211,"probabilities":{"0":0.1043,"1":0.2703,"2":0.6254},"confidence":0.2126}},"curated":{"title":"Fixes Content Security Policy errors for regional Google Analytics hosts","description":"With Google Analytics on, a view of the website from the EU has CSP console errors such as Refused to connect to region1.analytics.google.com because it violates the connect-src directive. The connect-src and img-src values in the GoogleGtag csp_whitelist.xml go from www.google-analytics.com and analytics.google.com to *.google-analytics.com and *.analytics.google.com.","categories":[],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":null},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-38991 details"}