Find your table for any occasion

Ad Stack Status

CSP Violations

Notes

This page enforces script-src 'nonce-SANDBOX_TEST_NONCE_123' 'strict-dynamic' 'unsafe-eval' 'report-sample' https:. Scripts without the correct nonce will be blocked unless injected by a nonced script (via 'strict-dynamic'). 'unsafe-inline' is intentionally omitted.

How This Test Page Mimics OpenTable

This page closely replicates the Content Security Policy observed on OpenTable's production site (www.opentable.com, confirmed August 2026). Some directives are intentionally loosened (connect-src *, media-src *) to isolate script/frame/image blocking behavior without unrelated noise. See the differences table below.

Key Differences From Production

Aspect	OpenTable Production	This Test Page
CSP delivery	HTTP response header	<meta> tag (no server)
Nonce	Server-generated, unique per request	Hardcoded (SANDBOX_TEST_NONCE_123)
GPT loading	Full SDK with consent UI	Stub (groups C0001, C0003, C0004 pre-consented)

script-src (Nonce-Based, Strict)

The core security measure. Scripts must either carry the page nonce or be injected by a nonced script ('strict-dynamic'). 'unsafe-inline' is NOT allowed — inline <script> blocks without a nonce are blocked.

• 'nonce-…' — only scripts with the correct nonce execute
• 'strict-dynamic' — scripts created via createElement('script') by a trusted (nonced) script are allowed
• 'unsafe-eval' — eval() and new Function() permitted (OpenTable allows this)
• 'report-sample' — violation reports include a sample of the blocked content
• https: — broad fallback for older browsers that don't support 'strict-dynamic'
• Explicit domains: cdn.cookielaw.org, cdn.otstatic.com, googletagmanager.com, doubleclick.net, googlesyndication.com, gstatic.com/recaptcha, spreedly.com, sift.opentable.com, akamaihd.net, maps.googleapis.com, js.stripe.com, google.com, cdn.intergient.com

img-src (Strict Whitelist)

Images are restricted to specific domains. Notably, ep1.adtrafficquality.google (used by GPT for ad quality SODAR pixels) is not whitelisted — this causes CSP violations even on OpenTable's own production site.

frame-src (Ad Iframes)

Ad iframes from doubleclick.net, googlesyndication.com, and tpc.googlesyndication.com are allowed.

Other Directives

• default-src 'self' — baseline: only same-origin
• style-src 'self' 'unsafe-inline' — inline styles permitted
• connect-src * — XHR/fetch unrestricted (permissive for testing)
• font-src 'self' data: https: — fonts from any HTTPS origin
• object-src 'none' — no plugins/embeds

Known Production CSP Issues on OpenTable

• 🔴 img-src blocks ep1.adtrafficquality.google — Google's GPT SODAR pixel is blocked
• 🟡 GPT uses deprecated APIs: disableInitialLoad, setCollapseEmptyDiv
• 🔴 dpx.airpr.com DNS failure — broken analytics tracker (not CSP-related)

What This Means for RAMP.js Integration

For RAMP.js to work on OpenTable, it must:

1. Accept a nonce (stamped on its <script> tag by the server)
2. Load all downstream scripts via document.createElement('script') with src attributes — these are allowed by 'strict-dynamic'
3. Avoid injecting inline <script> blocks via innerHTML or document.write — these will be blocked
4. Ensure GPT, Prebid, and A9 (apstag) are loaded as external scripts, not inline code