If your portal or website uses a Content Security Policy (CSP), it needs a few entries so the Messenger widget can load.

How the widget loads

The widget loads from the help desk address in your embed snippet and runs in an iframe from that address. Its own connections, including the websocket, follow the iframe's policy, not your site's. Your site's policy only needs to allow the loader script and the iframe.

Entries to add

Add your help desk address to these directives:

script-src https://<helpdesk address>
frame-src https://<helpdesk address>

Also allow these two inline items:

• The inline script that sets window.DpMessengerOptions. Use a nonce or hash, or move it into your own script file that loads before web.js.

• The small inline style the loader adds for full screen on mobile. A strict style-src blocks it. Allow it by its hash rather than adding 'unsafe-inline'. The CSP error in your browser console shows the hash to add.

💡 Note: Avoid 'unsafe-inline'. Allowing only these items by nonce or hash keeps the rest of your policy strict.

Troubleshooting

• The widget doesn't load on your site? Check your browser console for CSP errors, and add any blocked entries to your policy.

• The widget doesn't go full screen on mobile? The inline style is probably blocked. Add its hash to style-src.