Im generating a nonce-value on my CSP Header using netlify, and while Im seeing in my CSP header that the nonce-value is set, when inspecting the HTML, intercoms script tag does not contain the nonce value.
Can someone provide some insight into how to get intercom to initialize with the CSP Headers nonce value, or is that not possible?
Best answer by Diogo Silva
Hello
From my understanding, to initialize Intercom with the CSP header nonce value in Netlify, you need to ensure you are using Google's CSPv3 and including nonce sources for the scripts loaded by Messenger, something like this:
• Use Google's strict CSP policy:
Content-Security-Policy:
object-src 'none';
script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;
base-uri 'self';
• Include nonce fonts for Messenger scripts.
• If you need help with handling nonces, see Google's tutorial on CSP.
If you cannot use CSPv2 or v3 features, consider using origin allowlisting with the relevant directives for Intercom.
I hope this helps you :)
+2Hello
From my understanding, to initialize Intercom with the CSP header nonce value in Netlify, you need to ensure you are using Google's CSPv3 and including nonce sources for the scripts loaded by Messenger, something like this:
• Use Google's strict CSP policy:
Content-Security-Policy:
object-src 'none';
script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;
base-uri 'self';
• Include nonce fonts for Messenger scripts.
• If you need help with handling nonces, see Google's tutorial on CSP.
If you cannot use CSPv2 or v3 features, consider using origin allowlisting with the relevant directives for Intercom.
I hope this helps you :)
Yes i saw that in the article about integrating intercom with a CSP. The issue is that i do have the nonce present in my CSP, but its not being included in the intercom <script> tag when i look at the HTML. I was under the impression that this would work out of the box, but is there some configuration option im missing to have this populated on the script and styles tags?
Already have an account? Login
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
