Google Tag Manager

Forum Discussion

Rajorigin's avatar
Rajorigin
Expert
6 days ago

Custom HTML for Banners

Hello friends, Appreciate your thoughts on this, mainly from a security perspective. We were exploring custom HTML Banners in Braze. In this case, the SDK would render both the content payload and t...
data transformation
SDKs and APIs
DavidO's avatar
DavidO
Visionary
5 hours ago

Hi Rajorigin​ 

Although not perfect (nothing is) you can add to your <head> tag for example:

<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://js.appboycdn.com https://*.braze.com https://*.braze.eu 'unsafe-inline';">

to restrict scripts to trusted domains you are using. 'unsafe-inline' allows Braze to still inject srcript into the DOM which it usually needs in these scenarios but you can test it without that tag if you want to go safer again.