Add Google Tag Manager first-party integration by prk-Jr · Pull Request #262 · IABTechLab/trusted-server

prk-Jr · 2026-02-09T08:47:27Z

Scripts like GTM and GA4 are often blocked by ad blockers or privacy extensions when loaded from third-party domains, leading to data loss. Third-party cookie deprecation further limits tracking durability.

This change transparently proxies GTM/GA4 scripts and analytics beacons through the Trusted Server, establishing a first-party context. It automatically rewrites HTML tags (including <link rel="preload">) and script content to point to local proxy endpoints, bypassing blockers and extending cookie life.

Includes:

Proxy endpoints for gtm.js, gtag/js, /collect, and /g/collect with configurable caching and strict validation
Server-side HTML rewriting for src and href attributes targeting GTM/GA domains
Server-side script content rewriting to redirect internal GTM/GA calls through the proxy
Client-side script guard (DOM interception) for dynamically inserted scripts on Next.js and SPA sites
Privacy enhancement: client IP addresses are not forwarded to Google (Google sees only the edge server IP)
Regex hardened against subdomain spoofing (e.g., www.googletagmanager.com.evil.com)
Comprehensive testing: 18 unit/integration tests covering configuration, URL rewriting, HTML pipeline, header validation, and IP stripping

Manual Test Plan

Prerequisites: Configure .env with GTM enabled and a valid container ID, then start the local server.

1. Script proxy — gtm.js rewritten

curl -s 'http://127.0.0.1:7676/integrations/google_tag_manager/gtm.js?id=GTM-522ZT3X6' \
  | grep -c '/integrations/google_tag_manager'

Expected: count > 0

2. Script proxy — gtag/js returns 200

curl -s -o /dev/null -w '%{http_code}' \
  'http://127.0.0.1:7676/integrations/google_tag_manager/gtag/js?id=G-DQMZGMPHXN'

Expected: 200

3. gtag/js content rewritten (no Google domains)

curl -s 'http://127.0.0.1:7676/integrations/google_tag_manager/gtag/js?id=G-DQMZGMPHXN' \
  | grep -c 'www.google-analytics.com'

Expected: 0

4. Beacon proxy — POST /g/collect

curl -s -o /dev/null -w '%{http_code}' -X POST \
  'http://127.0.0.1:7676/integrations/google_tag_manager/g/collect?v=2&tid=G-TEST&cid=123&en=page_view' \
  -d 'v=2&tid=G-TEST'

Expected: 204 or 200

5. Beacon proxy — GET /collect

curl -s -o /dev/null -w '%{http_code}' \
  'http://127.0.0.1:7676/integrations/google_tag_manager/collect?v=2&tid=G-TEST'

Expected: 204 or 200

6. Cache headers present

curl -sI 'http://127.0.0.1:7676/integrations/google_tag_manager/gtm.js?id=GTM-522ZT3X6' \
  | grep -i cache-control

Expected: cache-control: public, max-age=900

Resolves: #224

Scripts like GTM and GA4 are often blocked by ad blockers and privacy extensions when loaded from third-party domains, leading to data loss. Third-party cookie deprecation further limits tracking durability. This change proxies GTM scripts and analytics beacons through the Trusted Server, establishing a first-party context. It automatically rewrites HTML tags and script content to point to local proxy endpoints, bypassing blockers and extending cookie life. Includes: Proxy endpoints for gtm.js and /collect Content rewriting for redirecting internal GTM calls Configuration and integration tests Resolves: #224

Adds comprehensive tests for: - GTM configuration parsing and default values - HTML processor pipeline integration - Response body rewriting logic

… in Google Tag Manager

aram356

🔧 Please make sure checks pass before assigning to review.

aram356

Good start. Need to address specific items and the following.

Duplicated rewrite logic across three places

The GTM URL rewriting logic exists in three separate methods: rewrite_gtm_script(), IntegrationAttributeRewriter::rewrite(), and IntegrationScriptRewriter::rewrite(). Each handles a slightly different set of patterns. This is error-prone — a new URL pattern needs to be added in multiple places.

crates/common/src/integrations/google_tag_manager.rs

trusted-server.toml

…, set default enablement to false, and update documentation for handling

crates/common/src/integrations/google_tag_manager.rs

…ID forwarding for GTM proxy requests

trusted-server.toml

crates/common/src/integrations/google_tag_manager.rs

docs/guide/integrations/google_tag_manager.md

…nctions, improving request configuration for beacons and scripts

…ogle Tag Manager integration

ChristianPavilonis

For the re-writes to work with nextjs sites we need to use the scriptGuard pattern. Next sites can load the scripts dynamically after the fact so we catch and rewrite the script tags client side also.

see: https://github.com/IABTechLab/trusted-server/blob/main/crates/js/lib/src/integrations/permutive/script_guard.ts

aram356 · 2026-02-19T17:16:10Z

@prk-Jr Please add (manual) test plan

aram356

Look good overall. I would like to see test plan and address script guard.

- Widen IntegrationAttributeRewriter to rewrite href/src for gtag/js and google-analytics.com URLs (not just gtm.js), fixing <link rel=preload> tags not being rewritten on Next.js sites - Add client-side script guard for dynamically inserted GTM/GA scripts using the shared createScriptGuard factory (matches DataDome pattern) - Harden URL regex with delimiter capture group to prevent subdomain spoofing (e.g., www.googletagmanager.com.evil.com) - Add is_rewritable_url helper to selectively rewrite only URLs with corresponding proxy routes (excludes ns.html) - Document gtag/js endpoint in integration guide

gtag.js constructs beacon URLs dynamically from bare domain strings, so rewriting them at the script level produces broken URLs. Instead, add a shared beacon_guard that patches navigator.sendBeacon and window.fetch at runtime to intercept requests to google-analytics.com and analytics.google.com, rewriting them to the first-party proxy. - Add shared beacon_guard.ts factory (sendBeacon + fetch interception) - Wire GTM integration to install beacon guard on init - Require // prefix in Rust GTM_URL_PATTERN to prevent bare domain rewrites - Add tests for both shared factory and GTM-specific beacon interception

crates/js/lib/test/shared/beacon_guard.test.ts

- Use status 200 instead of 204 (jsdom rejects 204 as null-body status) - Use absolute URLs in test rewriteUrl to satisfy jsdom's Request constructor

crates/js/lib/test/shared/beacon_guard.test.ts

aram356

@prk-Jr Please deploy to staging for autoblog.com I did not see in the plan.

aram356 · 2026-02-23T16:40:57Z

from @jevansnyc

There are some differences. For example the "Request Payload" data that shows up on autoblog and not ts.autoblog.com

prk-Jr · 2026-02-23T17:05:16Z

from @jevansnyc

There are some differences. For example the "Request Payload" data that shows up on autoblog and not ts.autoblog.com

I looked into it and I found something like this. @jevansnyc can you please point me to the request.

- Add container ID format validation (GTM-XXXXXX pattern) - Fix fragile beacon type detection using ends_with() - Improve error handling in TypeScript guards - Add beacon guard cleanup mechanism for testing - Document IP stripping privacy tradeoff - Document cache behavior and stale handling - Simplify upstream_url() logic (rely on serde defaults) All tests passing. No breaking changes.

prk-Jr self-assigned this Feb 9, 2026

Fix linting errors in google_tag_manager.rs and google_tag_manager.md

348f150

prk-Jr marked this pull request as draft February 9, 2026 09:20

prk-Jr marked this pull request as ready for review February 9, 2026 10:23

prk-Jr marked this pull request as draft February 9, 2026 10:24

Add configuration and pipeline integration tests

4d543e4

Adds comprehensive tests for: - GTM configuration parsing and default values - HTML processor pipeline integration - Response body rewriting logic

prk-Jr marked this pull request as ready for review February 9, 2026 11:13

prk-Jr requested review from ChristianPavilonis and aram356 February 9, 2026 13:24

prk-Jr added 3 commits February 9, 2026 21:22

Enhance GTM integration with caching, validation, and improved logging

4fd54b8

Enhance GTM integration with caching, validation, and improved logging

6486bd4

Add integration tests for HTML processing and inline script rewriting…

a02b7d8

… in Google Tag Manager

aram356 requested changes Feb 9, 2026

View reviewed changes

Merge branch 'main' into feat/gtm-integration

f322373

prk-Jr requested a review from aram356 February 10, 2026 12:20

aram356 requested changes Feb 13, 2026

View reviewed changes

Enhance Google Tag Manager integration with regex-based URL rewriting…

0d4a47e

…, set default enablement to false, and update documentation for handling

prk-Jr requested a review from aram356 February 13, 2026 09:33

aram356 reviewed Feb 16, 2026

View reviewed changes

crates/common/src/integrations/google_tag_manager.rs Show resolved Hide resolved

crates/common/src/integrations/google_tag_manager.rs Outdated Show resolved Hide resolved

crates/common/src/integrations/google_tag_manager.rs Outdated Show resolved Hide resolved

Add configurable cache max-age for GTM scripts and disable synthetic …

4f33b26

…ID forwarding for GTM proxy requests

prk-Jr requested a review from aram356 February 16, 2026 07:56

ChristianPavilonis requested changes Feb 16, 2026

View reviewed changes

trusted-server.toml Outdated Show resolved Hide resolved

crates/common/src/integrations/google_tag_manager.rs Show resolved Hide resolved

docs/guide/integrations/google_tag_manager.md Outdated Show resolved Hide resolved

feat: Add gtag.js support and refactor GTM proxy logic into helper fu…

61125a2

…nctions, improving request configuration for beacons and scripts

prk-Jr marked this pull request as draft February 16, 2026 16:07

fix: lint error on ci

6a96c7f

prk-Jr requested a review from ChristianPavilonis February 17, 2026 10:36

prk-Jr marked this pull request as ready for review February 17, 2026 11:29

Docs fix to clarify client IP handling and privacy enhancement for Go…

76b20be

…ogle Tag Manager integration

ChristianPavilonis requested changes Feb 18, 2026

View reviewed changes

aram356 approved these changes Feb 20, 2026

View reviewed changes

prk-Jr added 2 commits February 20, 2026 19:39

fix: ts lint

61a8260

prk-Jr requested review from ChristianPavilonis and aram356 February 20, 2026 14:31

prk-Jr marked this pull request as draft February 20, 2026 15:07

github-advanced-security bot found potential problems Feb 20, 2026

View reviewed changes

crates/js/lib/test/shared/beacon_guard.test.ts Fixed Show fixed Hide fixed

crates/js/lib/test/shared/beacon_guard.test.ts Dismissed Show dismissed Hide dismissed

Fix beacon guard tests for jsdom compatibility

f38cf89

- Use status 200 instead of 204 (jsdom rejects 204 as null-body status) - Use absolute URLs in test rewriteUrl to satisfy jsdom's Request constructor

github-advanced-security bot found potential problems Feb 20, 2026

View reviewed changes

crates/js/lib/test/shared/beacon_guard.test.ts Dismissed Show dismissed Hide dismissed

prk-Jr marked this pull request as ready for review February 20, 2026 15:51

ChristianPavilonis approved these changes Feb 20, 2026

View reviewed changes

aram356 requested changes Feb 20, 2026

View reviewed changes

Merge branch 'main' into feat/gtm-integration

0240992

prk-Jr added 2 commits February 24, 2026 12:37

Fix lint format issue

4a7ed37

prk-Jr requested a review from aram356 February 24, 2026 07:45

Comments

Conversation

prk-Jr commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual Test Plan

Uh oh!

aram356 left a comment

Choose a reason for hiding this comment

Uh oh!

aram356 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ChristianPavilonis left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aram356 commented Feb 19, 2026

Uh oh!

aram356 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aram356 left a comment

Choose a reason for hiding this comment

Uh oh!

aram356 commented Feb 23, 2026

Uh oh!

prk-Jr commented Feb 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

prk-Jr commented Feb 9, 2026 •

edited

Loading

ChristianPavilonis left a comment •

edited

Loading

aram356 left a comment •

edited

Loading