Security

Content Security Policy

If your application sends a Content Security Policy, the browser enforces it locally and blocks the Foldspace SDK no matter what your network allows. CSP is the most common reason the SDK fails to appear on an otherwise correct installation.

A firewall allow list is a separate control, enforced by your network rather than the browser. Allowing a domain in one place does not allow it in the other.

The policy

Content-Security-Policy:
  script-src 'self' 'unsafe-inline' https://script.eucerahive.io;
  connect-src 'self' https://rte.eucerahive.io https://recorder.eucerahive.io https://agent.eucerahive.io;
  style-src 'self' 'unsafe-inline';

https://*.eucerahive.io covers all four Foldspace hosts in a single entry if you prefer a wildcard. It matches subdomains only, and does not match the apex domain eucerahive.io.

Per-directive reference

Directive	Value	Why
`script-src`	`https://script.eucerahive.io`	Serves four files: the SDK loader, the session recorder, and the agent panel’s own scripts.
`script-src`	`'unsafe-inline'`	The install snippet is an inline `<script>`. Use a nonce or hash instead where you can.
`connect-src`	`https://rte.eucerahive.io`	Settings, feature flags, and usage events.
`connect-src`	`https://recorder.eucerahive.io`	Session recording uploads.
`connect-src`	`https://agent.eucerahive.io`	Agent requests and responses.
`style-src`	`'unsafe-inline'`	The panel injects `<style>` elements and sets inline `style` attributes.

What you don’t need

frame-src. The agent panel is an about:blank iframe built in the page, not a document fetched from a Foldspace origin. It inherits the parent policy, and frame-src 'none' does not block it.
img-src. The SDK loads no images from Foldspace domains.

Inline styles and nonces

The panel styles itself by injecting <style> elements and style attributes at runtime, so style-src needs 'unsafe-inline'.

script-src is different: the only inline script is the install snippet you control, so a nonce or a hash works there. When the snippet is blocked, the console prints the hash you can allow:

Executing inline script violates the following Content Security Policy directive
'script-src 'self''. Either the 'unsafe-inline' keyword, a hash
('sha256-kjaHMb9ph1GF2Ptx8VeUDYz4boSSsMTa8U0p2/NblC4='), or a nonce ('nonce-...')
is required to enable inline execution.

The hash changes whenever the snippet changes, including the Agent Key inside it.

Trusted Types

The SDK registers a Trusted Types policy named default. If your policy sets require-trusted-types-for 'script' with a trusted-types allowlist, include default in it, or the SDK cannot register and fails to start.

Using a meta tag

If you can’t set a response header, deliver the same policy from the page:

<meta
  http-equiv="Content-Security-Policy"
  content="script-src 'self' 'unsafe-inline' https://script.eucerahive.io; connect-src 'self' https://rte.eucerahive.io https://recorder.eucerahive.io https://agent.eucerahive.io; style-src 'self' 'unsafe-inline'"
/>

The tag has to appear before the SDK snippet, otherwise the browser applies it too late to matter.

Troubleshooting

The browser console names the directive that was violated. Read it and add the matching value from the table above. A few things worth checking:

Directives don’t inherit. A host allowed in script-src is not allowed in connect-src. Each directive is listed separately.
default-src is only a fallback. Declaring script-src or connect-src explicitly replaces default-src entirely for that resource type.
Two policies both apply. If a header and a meta tag are both present, a request must satisfy both. The result is the intersection, not the union.

To measure impact before enforcing a change, deploy the policy as Content-Security-Policy-Report-Only first. Violations are reported without blocking anything.

If the agent still doesn’t appear once CSP is clean, work through The agent isn’t appearing.