Laravel Gtm Laravel Package

Product Decisions This Supports

• Removing 'unsafe-inline' from your CSP without breaking tag management. The 3.1.0 release forwards Laravel's CSP nonce (Vite::cspNonce(), e.g. set by laravel-security-headers 2.1) onto the scripts this package injects and onto the gtm.js tag it creates. That turns a hard security/compliance trade-off into a configuration detail: you can adopt a strict script-src 'nonce-{nonce}' policy while keeping GTM/analytics instrumentation working.
• Security hardening as a roadmap item, not a rewrite. If tighter CSP is on the roadmap (pen-test findings, SOC 2 / ISO evidence, customer security questionnaires, internal platform standards), this release is evidence the package tracks the Laravel security ecosystem rather than blocking you. It supports a "keep, upgrade" decision over "build our own snippet injector."
• Build vs. buy for server-side tag injection. The alternative is hand-rolling snippet rendering in a Blade partial or service provider, which then has to be kept in sync with CSP nonce plumbing, consent handling, and Laravel/Vite changes. This release is exactly the kind of maintenance work you avoid by buying — nonce propagation is fiddly and easy to get subtly wrong.
• Consent- and policy-sensitive environments. Useful wherever a strict CSP coexists with marketing/analytics tags: regulated industries, enterprise/B2B tenants with security review gates, and any app where 'unsafe-inline' is flagged in audit.
• Feature framing for release notes / customer-facing security docs. "CSP nonce support" is a concrete, verifiable line item for security review responses and upgrade notes; it de-risks the upgrade conversation with security reviewers.
• Backward-compatible upgrade path. Stated behavior: nothing changes for apps without a nonce. That supports a low-ceremony upgrade decision — no migration work, no config change required, and no behavioral change for existing tenants.

When to Consider This Package

Consider it when:

• Your app uses (or plans to use) GTM or similar injected scripts and you want them rendered server-side from Laravel configuration rather than hard-coded in templates.
• You maintain, or are moving toward, a nonce-based CSP — particularly if you already use laravel-security-headers 2.1 or Vite::cspNonce(). The 3.1.0 nonce forwarding, including to the derived gtm.js tag, is the specific reason to adopt or upgrade now.
• You have audit, pen-test, or customer-security-review pressure to eliminate 'unsafe-inline' from script-src.
• You want snippet behavior centralized and versioned rather than duplicated across Blade layouts.

Look elsewhere or defer when:

• You have no CSP or nonce requirement and no near-term plan for one; the release adds no value to your current posture, though upgrading remains safe and zero-config.
• Your tag management already runs through a first-party, CSP-aware mechanism (e.g., a tag manager with its own nonce handling, or edge/server-side tagging) — you may be duplicating responsibility.
• You need consent-management gating, server-side event forwarding, or multi-tenant per-request tag configuration beyond what this package covers; confirm scope before committing.
• Your CSP is hash-based rather than nonce-based, or you cannot guarantee the nonce is set before the snippet renders — nonce ordering is the main integration risk to validate.

Adoption criteria: confirm the nonce is available at render time, verify the emitted scripts and gtm.js tag carry the nonce in a staging CSP with 'unsafe-inline' removed, and check that response caching or full-page caching doesn't serve a stale nonce.

How to Pitch It (Stakeholders)

For executives: A small, low-risk upgrade that removes a common security exception. Our analytics/marketing tags can now run under a strict Content Security Policy instead of the weaker 'unsafe-inline' allowance — closing a recurring finding in security reviews and customer questionnaires, at no migration cost. Apps that don't use a nonce see no change at all.

For engineering: Version 3.1.0 propagates Laravel's CSP nonce (Vite::cspNonce(), as set by laravel-security-headers 2.1) onto the scripts this package injects, and forwards it to the gtm.js tag it creates. That lets a policy allow these scripts via 'nonce-{nonce}' rather than 'unsafe-inline'. Fully backward compatible — no config or code changes required. Upgrade risk is low; the only real validation is confirming the nonce is set before render and is not cached across requests.

Recommendation: Upgrade to 3.1.0. Treat it as an enabler for tightening script-src to nonce-based in a follow-up change, validated in staging with 'unsafe-inline' removed.