Configure Content Security Policy

Start with the production snippet in Settings → Widget → Install. Derive each origin from its actual CAIRN_CDN, CAIRN_APP_URL and CAIRN_WS_URL values, keeping the scheme and any nonstandard port. Strip path and query parts for a CSP origin. The portal's installation instructions already substitute the correct origins.

Required directives

Append these sources to your existing policy. Keep the sources your own application needs. If a directive is absent, first copy its effective default-src sources into the new directive.

Example shape, with each uppercase origin replaced by the value derived from your issued snippet:

script-src 'self' 'nonce-PAGE_NONCE' CDN_ORIGIN;
connect-src 'self' CDN_ORIGIN APP_ORIGIN WEBSOCKET_ORIGIN;
img-src 'self' APP_ORIGIN data: blob:;
style-src 'self';
style-src-elem 'self' 'unsafe-inline';
style-src-attr 'none';

This is a starting shape, not a replacement for your existing policy. CSP sources are origins such as https://app.cairn.how, while a WebSocket source uses wss://…; do not paste the full socket URL containing /app/…?protocol=7. Do not add *, unsafe-eval, or a blanket inline-script exception.

Bootstrap nonces

If your policy uses a fresh nonce per response, add that nonce to both tags in the issued snippet: the globals tag and the loader tag. Apply the same script allowances to script-src-elem where present. Do not reuse a nonce across responses or hardcode one in a shared template.

If inline scripts are prohibited and you do not use nonces, put the portal's JavaScript installation form in a same-origin file and load that file with defer. Ensure it is permitted by your script policy. Keep identity tokens in a separate no-store authenticated server response.

Current style and Trusted Types limitations

The widget creates inline styles for its own panel. A nonce on its loader does not attach a nonce to those styles. A nonce-only or hash-only style policy therefore does not currently support this installation. Allowing 'unsafe-inline' in a separate style-src-elem permits inline style elements while keeping style-src-attr strict. That exception applies to style elements across the page, not exclusively to Cairn.

If your existing style-src-elem contains nonces or hashes, simply appending 'unsafe-inline' does not work: browsers ignore it in that combination. Review an explicit style-element policy change with your application owner, or hold installation until the required nonce support is available. Never claim that an untested strict policy is compatible.

The current widget does not support enforced Trusted Types (require-trusted-types-for 'script'). Report that policy before installing; relaxing it is an application security decision.

Verify on each surface

Test in your actual production CSP, including a policy supplied by a CDN, reverse proxy, framework middleware or <meta> tag. Multiple policies apply together, so fixing only one header may leave the widget blocked. Use report-only mode to observe proposed changes, then test with enforcement.

Check the loader, manifest, bundle, verified session, realtime socket, launcher icon, a screenshot-bearing guide and an Experiences tour. Review console violations, network failures and your CSP report destination. Repeat after customer/seller/admin login and at mobile width. Record sanitized violations without identity tokens, URL signing tokens or customer content.