# Content Security Policy

The CSP directives the Foldspace SDK requires, verified against the running SDK.

If your application sends a **Content Security Policy**, the browser enforces it locally and blocks the Foldspace SDK no matter what your network allows. CSP is the most common reason the SDK fails to appear on an otherwise correct installation.

A firewall [allow list](/security/domain-allow-list/) is a separate control, enforced by your network rather than the browser. Allowing a domain in one place does not allow it in the other.

## The policy

```
Content-Security-Policy:
  script-src 'self' 'unsafe-inline' https://script.eucerahive.io;
  connect-src 'self' https://rte.eucerahive.io https://recorder.eucerahive.io https://agent.eucerahive.io;
  style-src 'self' 'unsafe-inline';
```

`https://*.eucerahive.io` covers all four Foldspace hosts in a single entry if you prefer a wildcard. It matches subdomains only, and does not match the apex domain `eucerahive.io`.

## Per-directive reference

| Directive | Value | Why |
| :--- | :--- | :--- |
| `script-src` | `https://script.eucerahive.io` | Serves four files: the SDK loader, the session recorder, and the agent panel's own scripts. |
| `script-src` | `'unsafe-inline'` | The install snippet is an inline `<script>`. Use a nonce or hash instead where you can. |
| `connect-src` | `https://rte.eucerahive.io` | Settings, feature flags, and usage events. |
| `connect-src` | `https://recorder.eucerahive.io` | Session recording uploads. |
| `connect-src` | `https://agent.eucerahive.io` | Agent requests and responses. |
| `style-src` | `'unsafe-inline'` | The panel injects `<style>` elements and sets inline `style` attributes. |

### What you don't need

- **`frame-src`.** The agent panel is an `about:blank` iframe built in the page, not a document fetched from a Foldspace origin. It inherits the parent policy, and `frame-src 'none'` does not block it.
- **`img-src`.** The SDK loads no images from Foldspace domains.

## Inline styles and nonces

The panel styles itself by injecting `<style>` elements and `style` attributes at runtime, so `style-src` needs `'unsafe-inline'`.

:::note
Adding a nonce to `style-src` makes browsers ignore `'unsafe-inline'` in that directive.
If you nonce your styles, the panel loses its styling. Nonce your scripts if you want to,
but leave `style-src` on `'unsafe-inline'`.
:::

`script-src` is different: the only inline script is the install snippet you control, so a nonce or a hash works there. When the snippet is blocked, the console prints the hash you can allow:

```
Executing inline script violates the following Content Security Policy directive
'script-src 'self''. Either the 'unsafe-inline' keyword, a hash
('sha256-kjaHMb9ph1GF2Ptx8VeUDYz4boSSsMTa8U0p2/NblC4='), or a nonce ('nonce-...')
is required to enable inline execution.
```

The hash changes whenever the snippet changes, including the Agent Key inside it.

## Trusted Types

The SDK registers a Trusted Types policy named `default`. If your policy sets `require-trusted-types-for 'script'` with a `trusted-types` allowlist, include `default` in it, or the SDK cannot register and fails to start.

## Using a meta tag

If you can't set a response header, deliver the same policy from the page:

```html
<meta
  http-equiv="Content-Security-Policy"
  content="script-src 'self' 'unsafe-inline' https://script.eucerahive.io; connect-src 'self' https://rte.eucerahive.io https://recorder.eucerahive.io https://agent.eucerahive.io; style-src 'self' 'unsafe-inline'"
/>
```

The tag has to appear before the SDK snippet, otherwise the browser applies it too late to matter.

## Troubleshooting

The browser console names the directive that was violated. Read it and add the matching value from the table above. A few things worth checking:

- **Directives don't inherit.** A host allowed in `script-src` is not allowed in `connect-src`. Each directive is listed separately.
- **`default-src` is only a fallback.** Declaring `script-src` or `connect-src` explicitly replaces `default-src` entirely for that resource type.
- **Two policies both apply.** If a header and a meta tag are both present, a request must satisfy both. The result is the intersection, not the union.

To measure impact before enforcing a change, deploy the policy as `Content-Security-Policy-Report-Only` first. Violations are reported without blocking anything.

If the agent still doesn't appear once CSP is clean, work through [The agent isn't appearing](/start/agent-not-appearing/).