Content Security Policy
The CSP directives the ShopAssist widget needs, per platform, including Trusted Types and Cloudflare Turnstile.
If your store sends a Content-Security-Policy header, add these sources. The widget never needs 'unsafe-eval' or 'unsafe-inline'.
script-src https://cdn.shopassist.coec.dk; connect-src https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk; img-src https://cdn.shopassist.coec.dk <store media hosts> blob:; style-src https://cdn.shopassist.coec.dk| Directive | Sources | Why |
|---|---|---|
script-src | https://cdn.shopassist.coec.dk | The loader and the chat app. Shopify serves the loader from the theme asset host; the app still needs our CDN. |
connect-src | https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk | The widget API, streamed replies (SSE over fetch), the analytics beacon, the signed manifest and language packs. |
img-src | https://cdn.shopassist.coec.dk <your store media hosts> blob: | Avatars and logos from our CDN, product and store images from your own media hosts, blob: for photo previews and attachments. |
style-src | https://cdn.shopassist.coec.dk | Only used when the browser cannot apply constructable stylesheets (older Safari). 'unsafe-inline' is never needed. |
trusted-types | shopassist | Only when you enforce require-trusted-types-for 'script'. |
<store media hosts> are the hosts your product and store images come from (for example cdn.shopify.com or your own CDN).
Trusted Types
If you enforce require-trusted-types-for 'script', also add trusted-types shopassist. The widget creates exactly one policy, named shopassist, that only allows its own asset URLs.
Cloudflare Turnstile
If you enabled Turnstile for bot protection, add https://challenges.cloudflare.com to script-src and frame-src:
script-src https://cdn.shopassist.coec.dk https://challenges.cloudflare.com; connect-src https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk; img-src https://cdn.shopassist.coec.dk <store media hosts> blob:; style-src https://cdn.shopassist.coec.dk; frame-src https://challenges.cloudflare.com| Directive | Sources | Why |
|---|---|---|
script-src | https://cdn.shopassist.coec.dk | The loader and the chat app. Shopify serves the loader from the theme asset host; the app still needs our CDN. |
connect-src | https://api.shopassist.coec.dk https://cdn.shopassist.coec.dk | The widget API, streamed replies (SSE over fetch), the analytics beacon, the signed manifest and language packs. |
img-src | https://cdn.shopassist.coec.dk <your store media hosts> blob: | Avatars and logos from our CDN, product and store images from your own media hosts, blob: for photo previews and attachments. |
style-src | https://cdn.shopassist.coec.dk | Only used when the browser cannot apply constructable stylesheets (older Safari). 'unsafe-inline' is never needed. |
trusted-types | shopassist | Only when you enforce require-trusted-types-for 'script'. |
Not needed
unsafe-eval, unsafe-inline, font-src, worker-src, form-action, media-src, and frame-src (except for Turnstile). Streamed replies use fetch, covered by connect-src.
Per platform
- Shopify: the loader is served from your theme's asset host, which Shopify's CSP already allows; the app still needs
cdn.shopassist.coec.dk. - Magento 2: the module ships
etc/csp_whitelist.xmlwith these hosts. Hyvä CSP themes work because the module renders no inline script. - WooCommerce and PrestaShop: add the directives in your security-header plugin or server configuration.
- Strict CSP or headless: use the SRI-pinned loader.
Errors in the browser console: CSP errors.
Last updated on