Hi Duane,

Perhaps the GUID value is always the same and we can use hash whitelist for this script too?

This GUID is different for every pageview, it is the pageview id. So unfortunately you cannot whitelist a single hash for that script.

However, it is possible to add the nonce with some custom code. This uses the same mechanism we use to inject the script tag into the HTML -- an implementation of our IRequestFilter interface.

Please try this and let us know if it works for you too.

public class ScriptNonceFilter : IRequestFilter
{
    private static readonly Regex _re = new(@"<script(?=>typeof uMarketingSuite!==""undefined""&&uMarketingSuite.analytics&&uMarketingSuite.analytics.init\(""[^""]+""\)</script>)");

    public int Priority => -1; // Run after any uMarketingSuite filters

    public void Filter(UMarketingSuiteRequestContext context, Action<Func<string, string>> writeContent)
    {
        writeContent(contents =>
        {
            var nonce = "YOUR_NONCE_HERE";
            return _re.Replace(contents, $"<script nonce=\"{nonce}\"");
        });
    }
}

public class ScriptNonceFilterComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
    {
        builder.Services.AddTransient<IRequestFilter, ScriptNonceFilter>();
    }
}

Regards,

Daniël