For security (but in our case also regulatory requirements) we need to strictly adherence to secure Content Security Policies (CSP). Currently, Intercom requires the use of unsafe-inline for styles in the style-src directive, which undermines security and fails to meet compliance standards.
We propose a solution that ensures Intercom can function seamlessly without requiring unsafe-inline by introducing nonce support for inline styles or externalizing injected styles.
Possible solutions:
- Nonce Support for Inline Styles:
Allow Intercom to detect and apply CSP nonces from the host application’s CSP configuration. Use the nonce value specified in the CSP meta tag or header for all dynamically injected styles, ensuring compatibility without sacrificing security. - Externalization of Injected Styles:
Intercom-generated inline styles are automatically converted into external stylesheets hosted on Intercom's CDN. The external stylesheets can then be whitelisted in the CSP using specific domains (e.g., https://*.intercomcdn.com).
