Content Security Policy (CSP) is a header sent by a web server to a browser.

It is used to declare which dynamic resources are allowed to load on your website.

CSP allows you to create a list of directives specifying which external resources (or scripts) can be used in the application. This restriction is intended to prevent XSS attacks that attach scripts loaded from other network locations to the page sources. All resources that do not match the policy will be rejected by the browser, and the browser itself will report a policy violation error.

If you detect CSP errors on your website, your development team or hosting provider will need to adjust the CSP settings.

Adjusting CSP settings

Step 1 - Check for CSP errors

If you see problems with displaying the survey on your website, sometimes it can be caused by a CSP error. You can check your browser's console to find errors. If you don't know how to do this, use this guide.

If a Content Security Policy issue occurs, you will see an error similar to the following:

Step 2 - Consult your developer or hosting provider to adjust CSP settings

Because all servers are different, the CustomerHero support team will not be able to help resolve these issues other than identifying if a CSP error is occurring. When making changes to your content security policy, the best person to contact is your web application developer or the person managing your website.

Step 3 - Choose CSP settings

Below is a set of rules that must be added to allow the website survey to function properly.

The ellipsis (...) in the examples below is a placeholder for any existing rules you already have:

script-src ... https://*.startquestion.com 'unsafe-inline' 'unsafe-eval'
img-src ... https://*.webankieta.pl https://*.startquestion.com data:
style-src ... 'unsafe-inline'
connect-src ... https://*.startquestion.com;

However, if you need more specific entries:

script-src ... https://library.startquestion.com https://app.startquestion.com https://files.startquestion.com
'unsafe-inline' 'unsafe-eval'
img-src ... https://files.webankieta.pl https://files.startquestion.com data: 
style-src ... 'unsafe-inline'
connect-src ... https://app.startquestion.com;`

Attention!

If the unsafe-eval value is omitted in the script-src directive, surveys that have the JavaScript Code rule will not be displayed.

Additional information

If the unsafe-inline value cannot be added to the script-src directive, we encourage you to apply security in the form of a nonce value according to this guide.

Adding a 'nonce' value

To add a 'nonce' value to the widget code, you need to modify our snippet. The 'nonce' value should be added in two places, which are shown in the screenshot below:

Description: In the example above, we generated a one-time value '6JDFIvPbrWANKpSJ8vlv6b==' for the 'nonce' attribute.

For the 'nonce' solution to ensure security, please remember that the 'nonce' value:

- must be different every time we refresh the page,

- must be sufficiently long (at least 128 bits),

- should be generated using a cryptographically secure pseudorandom number generator.