The script tag: identity, signing and CSP
What each part of the snippet does, how to sign who is reporting, and the Content Security Policy to merge.
You’ll need
- A tuix project
- A backend that knows the signed-in user
Transcript
1. Read the snippet
- The first line queues calls until the widget arrives.
- project is your public key.
- environment keeps local, UAT and production reports apart.
- identify names the person. The hash proves it came from your server.
- The loader URL pins one build, with a matching integrity hash.
- Use one project for all three, and set the environment per deployment.
2. Sign the identity on your server
- On your backend, sign the same ID you pass to identify.
- With an email, sign the ID, a newline and the lowercased email.
- Send the hex digest to the page as hash. The Phoenix, Rails and Node packages do this for you.
- Require HMAC-signed commenter identity stays on.
- Without it, anyone with your public key could pretend to be one of your users.
- When someone signs out, clear the identity.