Answers about csp
Questions and answers from the Croct community about csp.
14
Does Croct work under a strict Content-Security-Policy?
We run a strict CSP, no unsafe-inline anywhere. The last visual testing tool we evaluated required inline script injection for its variants, which would have…
0
After moving Croct behind our own domain, what CSP directives are still needed?
We recently completed a first-party proxying rollout for Croct requests, using the baseEndpointUrl and cidAssignerEndpointUrl options to route SDK traffic…
2
Our CSP forbids inline script injection and the visual testing tool cannot function, alternatives?
Platform engineer at a bank subsidiary, so our Content-Security-Policy is deliberately strict: script-src with nonces only, no unsafe-inline, no unsafe-eval.…