Documentation navigation
Documentation

Chatlio with Content Security Policy (CSP)

You can use Chatlio with Content Security Policy (CSP) headers. If you load the Chatlio embed code from a javascript file, you can avoid the use of script-src 'unsafe-inline'.

The short version

If you want the fewest rules, these three lines are enough:

default-src 'self' https://*.chatlio.com wss://*.chatlio.com;
style-src 'self' 'unsafe-inline' https://*.chatlio.com;
img-src * data:;

What each line does:

  • default-src covers the widget’s script and its connections. A browser uses this line for scripts and connections when your policy has no script-src or connect-src line.
  • style-src lets the widget apply its styles.
  • img-src lets the widget show images in messages and its own icons. The icons are built into the widget as data: images, so keep data:.

One line isn’t enough. A single default-src line would also need 'unsafe-inline' for the widget’s styles, and on that line it allows inline scripts too.

If your policy already has these lines

If your policy has its own script-src and connect-src lines, add Chatlio to each one:

default-src 'self' https://*.chatlio.com;
script-src 'self' https://*.chatlio.com;
connect-src 'self' https://*.chatlio.com wss://*.chatlio.com;
img-src * data:;
object-src 'none';
style-src 'unsafe-inline' https://*.chatlio.com;

Chatlio doesn’t need object-src 'none'. It’s a good rule to keep if you already have it.

Missing arrows or icons

If the widget shows a blank round button, or the arrow that minimizes the chat is missing, your img-src line doesn’t allow data:. Add data: to it.

Keep the wss:// entry

The widget receives replies over a live connection to wss://api.chatlio.com, and a host listed without wss://, such as api.chatlio.com or *.chatlio.com, doesn’t cover it. If your browser blocks that connection, the widget still works, but replies reach your visitors more slowly. If you list hosts one by one, include wss://api.chatlio.com.

Please contact us via our widget below if you have any questions or concerns about using Chatlio with CSP. We are happy to assist.