Troubleshooting
CSP errors
Fix Content Security Policy errors that block the ShopAssist widget on your storefront.
If your store sends a Content-Security-Policy header, the browser blocks anything the policy does not allow. The browser console then shows errors such as Refused to load the script 'https://cdn.shopassist.coec.dk/…' or Refused to connect to 'https://api.shopassist.coec.dk/…'.
Fix
Add the ShopAssist hosts to your policy:
script-src https://cdn.shopassist.coec.dk; connect-src https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk; img-src https://cdn.shopassist.coec.dk <store media hosts> blob:; style-src https://cdn.shopassist.coec.dk| Directive | Sources | Why |
|---|---|---|
script-src | https://cdn.shopassist.coec.dk | The loader and the chat app. Shopify serves the loader from the theme asset host; the app still needs our CDN. |
connect-src | https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk | The widget API, streamed replies (SSE over fetch), the analytics beacon, the signed manifest and language packs. |
img-src | https://cdn.shopassist.coec.dk <your store media hosts> blob: | Avatars and logos from our CDN, product and store images from your own media hosts, blob: for photo previews and attachments. |
style-src | https://cdn.shopassist.coec.dk | Only used when the browser cannot apply constructable stylesheets (older Safari). 'unsafe-inline' is never needed. |
trusted-types | shopassist | Only when you enforce require-trusted-types-for 'script'. |
The full list with explanations is in Content Security Policy.
Common causes
script-srcis missinghttps://cdn.shopassist.coec.dk, so the loader is blocked.connect-srcis missinghttps://api.shopassist.coec.dk, so the widget loads but cannot chat.img-srcdoes not allow your product image CDN, so product cards show no images.- A nonce or strict-dynamic policy: add the nonce to the ShopAssist script tag, or use the SRI-pinned loader.
Content-Security-Policy-Report-Onlyonly reports; it does not block. Look for the enforcing header.
The widget uses no eval and no inline scripts, so you never need 'unsafe-eval' or 'unsafe-inline' for it.
Last updated on