title: Google Analytics Code is being blocked by CSP
body: <p>I have a simple localhost website to test out Google Analytics, but every time I go to the site and look at the log, I see the JavaScript code is being blocked by CSP. </p>
  
  <p>Here's the script:</p>
  
  <pre><code>&lt;script type="text/javascript"&gt;
  
      (function (i, s, o, g, r, a, m) {
          i['GoogleAnalyticsObject'] = r; i[r] = i[r] || function () {
              (i[r].q = i[r].q || []).push(arguments)
          }, i[r].l = 1 * new Date(); a = s.createElement(o),
          m = s.getElementsByTagName(o)[0]; a.async = 1; a.src = g; m.parentNode.insertBefore(a, m)
      })(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');
  
      ga('create', 'UA-12345678-1', 'auto', { 'siteSpeedSampleRate': 100 });
      ga('send', 'pageview');
  
      ga('create', 'UA-87654321-1', 'auto', 'clientTracker', { 'siteSpeedSampleRate': 100 });
      ga('clientTracker.send', 'pageview');
  
  &lt;/script&gt;
  </code></pre>
  
  <p>And here's the CSP content:</p>
  
  <pre><code>  &lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;add name="Content-Security-Policy" value="default-src 'self'; script-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' http://www.google-analytics.com https://ssl.google-analytics.com; object-src 'none'; media-src 'none'; frame-src 'none' "/&gt;
        &lt;/customHeaders&gt;
    &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>Finally here's the screen shot of the errors:
  <a href="https://i.stack.imgur.com/o4bLm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/o4bLm.png" alt="enter image description here"></a></p>
  
  <p>note: I did come across with a few posts (<a href="https://stackoverflow.com/questions/14592598/google-analytics-and-content-security-policy-header">here</a> and <a href="https://stackoverflow.com/questions/29282313/check-if-analytics-js-is-loaded#comment46762826_29282313">here</a>), while I found some similarities in them, I don't find the solution worked for me (or maybe I did something wrong, if so, please point out). </p>