Skip to content
ShopAssist Docs
Widget

SRI-pinned loader

Embed a fixed widget version with Subresource Integrity for an end-to-end integrity chain under strict security policies.

View as Markdown

The channel loader (/widget/v1/loader.js) always serves the current widget and verifies a signed manifest before loading the chat app. A pinned loader is a fixed version with a published Subresource Integrity hash, so the browser refuses any changed file:

<script src="https://cdn.shopassist.coec.dk/widget/<version>/loader.js" async
        integrity="sha384-<published hash>" crossorigin="anonymous"
        data-shopassist-key="pk_live_YOUR_PUBLISHABLE_KEY" data-platform="generic"></script>

The first pinned release is published with the widget's general availability; until then use the channel loader below. Your dashboard shows the current version and hash.

How the chain works

  • The pinned loader.js is checked by the browser against integrity.
  • The loader has the file names and hashes of the app, its styles and language packs built in, and loads each with SRI.
  • Nothing is fetched without a hash, so a compromised CDN can't change what runs on your page.

Updating

A pinned version never changes. Security fixes and new features need a new version: update the src and integrity. The dashboard shows "Your pinned widget 1.2.0 is 3 minor versions behind" when you fall behind; plugins and the changelog list releases.

Plugins can pin a version too (in their advanced settings); they then print the same tag.

Last updated on

Content Security Policy

The CSP directives the ShopAssist widget needs, per platform, including Trusted Types and Cloudflare Turnstile.

Consent and CMP

How the widget reads consent from your consent management platform, the supported CMPs and category mappings, and manual mode.

On this page

How the chain worksUpdating