Content Security Policy

Intro

Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.

If you use CSP on your website, you need to add one of the following rules to make Lime Connect work.

Rule with font loading

Use this CSP rule when you intend to use custom webfonts in the Website Messenger.

markdown
child-src 'self' api.userlike.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-cdn-widgets.userlike.com userlike-cdn-umm.b-cdn.net blob:;
connect-src wss://umd.userlike.com umd.userlike.com api.userlike.com userlike-cdn-web.b-cdn.net userlike-cdn-umm.b-cdn.net www.userlike.com blob: userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-store-media-files.s3.amazonaws.com;
font-src data: userlike-cdn-umm.b-cdn.net fonts.gstatic.com;
frame-src 'self' api.userlike.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-cdn-widgets.userlike.com userlike-cdn-umm.b-cdn.net www.youtube.com player.vimeo.com;
img-src data: userlike-cdn-operators.userlike.com userlike-cdn-operators.s3-eu-west-1.amazonaws.com userlike-cdn-operators.userlike.com userlike-cdn-web.b-cdn.net www.userlike.com userlike-store-media-files.s3.amazonaws.com i.ytimg.com blob:;
media-src userlike-cdn-umm.b-cdn.net userlike-store-media-files.s3.amazonaws.com www.userlike.com blob:;
object-src 'none';
script-src 'self' api.userlike.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-cdn-widgets.userlike.com userlike-cdn-umm.b-cdn.net 'wasm-unsafe-eval';
style-src 'unsafe-inline';

Rule without font loading

Use this CSP rule when you intend to use system fonts in the Website Messenger.

markdown
child-src 'self' api.userlike.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-cdn-widgets.userlike.com userlike-cdn-umm.b-cdn.net blob:;
connect-src wss://umd.userlike.com umd.userlike.com api.userlike.com userlike-cdn-web.b-cdn.net userlike-cdn-umm.b-cdn.net www.userlike.com blob: userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-store-media-files.s3.amazonaws.com;
frame-src 'self' api.userlike.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-cdn-widgets.userlike.com userlike-cdn-umm.b-cdn.net www.youtube.com player.vimeo.com;
img-src data: userlike-cdn-operators.userlike.com userlike-cdn-operators.s3-eu-west-1.amazonaws.com userlike-cdn-operators.userlike.com userlike-cdn-web.b-cdn.net www.userlike.com userlike-store-media-files.s3.amazonaws.com i.ytimg.com blob:;
media-src userlike-cdn-umm.b-cdn.net userlike-store-media-files.s3.amazonaws.com www.userlike.com blob:;
object-src 'none';
script-src 'self' api.userlike.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com userlike-cdn-widgets.userlike.com userlike-cdn-umm.b-cdn.net 'wasm-unsafe-eval';
style-src 'unsafe-inline';

Using Our Widget with a Strict CSP Policy

Our widget relies on dynamically injected inline scripts and styles to function correctly. If you’re enforcing a strict Content Security Policy (CSP), we recommend using a CSP nonce—a unique, cryptographically secure token added to specific inline scripts and styles.

A CSP nonce ensures that only scripts and styles with the matching token are executed, while all others are blocked.

👉 Learn more about CSP nonces: https://content-security-policy.com/nonce/

If your site uses CSP nonces, add your nonce to the script tag that loads Lime Connect, using the nonce attribute:

plain text
<script async type="text/javascript" src="https://userlike-cdn-widgets...." nonce="YOUR_NONCE"></script>

If you load the Website Messenger with the Messenger API instead, pass your nonce when you mount it. 📘 For setup instructions, check out our documentation:

https://docs.lime-connect.com/developers/api/website-messenger

Example:

plain text
api.mount({ nonce: 'YOUR_NONCE' })

⚠️ Note: Due to technical limitations, the voice recording and emoji picker features are not available when using a CSP nonce.