-
Notifications
You must be signed in to change notification settings - Fork 9
Description
I just used the extension with EXT:dp_cookieconsent and checked the network connections.
I saw a connection to an external script, which I only wanted to load after cookie acceptance, even though no cookies were accepted.
Also the script tag was still of type text/plain and had an empty src attribute.
Then I found the URL inside the link HTTP header.
The script was included via page.headerData like this:
page.headerData.10 = TEXT
page.headerData.10.value (
<script data-ignore="1" data-cookieconsent="statistics" type="text/plain" data-src="https://www.googletagmanager.com/gtag/js?id=UA-XXXXXXX-XX"></script>
)
I guess the RegEx checks for something like <script ...src=""></script> and therefore pushes the unwanted resource.
Even if I used another cookie consent tool, the data-src attribute is used in most cases.
For now I load external scripts via JS, but I would appreciate, if the extension respected the data-src attribute.
I know, that cookies are not set on preload, but I would like to prevent the connection completely to prevent confusion when checking GDPR compliance.