# CSP errors

> Fix Content Security Policy errors that block the ShopAssist widget on your storefront.

Source: https://shopassist.coec.dk/docs/troubleshooting/csp-errors · Updated 2026-10-01

If your store sends a `Content-Security-Policy` header, the browser blocks anything the policy does not allow. The browser console then shows errors such as `Refused to load the script 'https://cdn.shopassist.coec.dk/…'` or `Refused to connect to 'https://api.shopassist.coec.dk/…'`.

## Fix [#fix]

Add the ShopAssist hosts to your policy:

```text
script-src https://cdn.shopassist.coec.dk; connect-src https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk; img-src https://cdn.shopassist.coec.dk <store media hosts> blob:; style-src https://cdn.shopassist.coec.dk
```

| Directive | Sources | Why |
| --- | --- | --- |
| `script-src` | `https://cdn.shopassist.coec.dk` | The loader and the chat app. Shopify serves the loader from the theme asset host; the app still needs our CDN. |
| `connect-src` | `https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk` | The widget API, streamed replies (SSE over fetch), the analytics beacon, the signed manifest and language packs. |
| `img-src` | `https://cdn.shopassist.coec.dk <your store media hosts> blob:` | Avatars and logos from our CDN, product and store images from your own media hosts, blob: for photo previews and attachments. |
| `style-src` | `https://cdn.shopassist.coec.dk` | Only used when the browser cannot apply constructable stylesheets (older Safari). 'unsafe-inline' is never needed. |
| `trusted-types` | `shopassist` | Only when you enforce require-trusted-types-for 'script'. |

The full list with explanations is in [Content Security Policy](/docs/widget/content-security-policy).

## Common causes [#causes]

* **`script-src`** is missing `https://cdn.shopassist.coec.dk`, so the loader is blocked.
* **`connect-src`** is missing `https://api.shopassist.coec.dk`, so the widget loads but cannot chat.
* **`img-src`** does not allow your product image CDN, so product cards show no images.
* A **nonce** or **strict-dynamic** policy: add the nonce to the ShopAssist script tag, or use the [SRI-pinned loader](/docs/widget/sri-pinned-loader).
* **`Content-Security-Policy-Report-Only`** only reports; it does not block. Look for the enforcing header.

The widget uses no `eval` and no inline scripts, so you never need `'unsafe-eval'` or `'unsafe-inline'` for it.