Content Security Policy

Permit the Assistant without weakening the rest of your site's Content Security Policy.

Use the exact script and network origins shown by the current installation snippet and your browser's CSP reports. The public Assistant contract does not publish a permanent origin allowlist, so a copied list can become stale as delivery infrastructure changes.

Rollout procedure

  1. Install the Assistant on a staging origin.
  2. Enable Content-Security-Policy-Report-Only.
  3. Load every enabled screen: home, Chat, Contact, Order Status, and Knowledge Base.
  4. Add only the blocked ThriveDesk origins to script-src, connect-src, img-src, and style-src.
  5. Repeat with an authenticated and anonymous browser before enforcing the policy.
Content-Security-Policy-Report-Only:
  default-src 'self';
  script-src 'self' https://ASSISTANT_SCRIPT_ORIGIN;
  connect-src 'self' https://ASSISTANT_API_ORIGIN wss://ASSISTANT_REALTIME_ORIGIN;
  img-src 'self' data: https://ASSISTANT_ASSET_ORIGIN;
  style-src 'self' 'unsafe-inline';
  report-uri /csp-reports

Replace every placeholder from observed requests; do not deploy the example literally. Avoid *, and never add unsafe-eval just to silence an unrelated console error.

Styling and CSS overrides

Inject scoped CSS after the Assistant Shadow DOM is connected.

Assistant troubleshooting

Diagnose loading, initialization, method, styling, and session problems.

Rollout procedure
Related