Problem/Motivation

<script src="/modules/contrib/klaro/js/klaro_placeholder.js" defer="defer" data-type="text/javascript" type="text/plain" data-name="unknown_app" data-src="https://js.stripe.com/v3/"></script>
is being auto-blocked. Guess we should add a service for stripe?

(Added through commerce_stripe in our case.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#10 klaro-3568262-MR117-10.patch787 byteslrwebks

Issue fork klaro-3568262

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

anybody created an issue. See original summary.

anybody opened merge request !117

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Status: Active » Needs review

I think we should make this functional and required?

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Status: Needs review » Needs work

Mhm even with opt_out: true and all config like in the MR, the JS is being auto-blocked if no consent is given:

<script src="/modules/contrib/klaro/js/klaro_placeholder.js" defer="defer" data-type="text/javascript" type="text/plain" data-name="stripe" data-src="https://js.stripe.com/v3/"></script>

The log entry was:

Unbekannte externe Ressource https://js.stripe.com/v3/ angefordert, wir empfehlen, einen Dienst für diese Ressource zu erstellen.

I would expect that with <code>opt_out: true the script should not get blocked server-side?

I finally entered the following sources but with no luck:

stripe.com
js.stripe.com
https://js.stripe.com
https://js.stripe.com/v3/

What am I doing wrong?

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

Even with Block unknown sources disabled (and yes, all caches cleared) the script is blocked?!

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

Okay I created #3568267: Scripts matching source + Opt-Out + Toggled by default (+required) should not get blocked server-side because I think blocking such scripts server-side is unexpected logically from the users perspective.
Otherwise I don't see a way to not block such scripts server-side at all, so that they can be loaded

Disabling the handling is currently only possible through global settings then.

grevil made their first commit to this issue’s fork.

grevil’s picture

grevil commented
Status: Needs work » Reviewed & tested by the community

LGTM!

Only removed "js.stripe.com", since "stripe.com" already matches that case.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

Thanks @grevil yes that was just a test because I wasn't able to make it work as expected due to #3568267: Scripts matching source + Opt-Out + Toggled by default (+required) should not get blocked server-side

I think a broad match for stripe.com makes sense.

lrwebks’s picture

lrwebks commented
StatusFileSize
new klaro-3568262-MR117-10.patch787 bytes

Static patch until this is merged

jan kellermann made their first commit to this issue’s fork.

jan kellermann’s picture

jan kellermann commented
Status: Reviewed & tested by the community » Fixed

Thank you for this issue and new service. I merged for next release.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.