Widget Content Security Policy

If your site has a strict Content Security Policy, the widget needs explicit allowances. Without them, the loader script, the iframe, and asset fetches will all be blocked.

Minimum directives

script-src  https://www.feedjolt.com
connect-src https://www.feedjolt.com
frame-src   https://www.feedjolt.com
img-src     https://cdn.feedjolt.com data: blob:
style-src   'unsafe-inline'
font-src    https://www.feedjolt.com data:

If you already use default-src 'self', the directives above are additions - they don't replace your existing ones.

Per-directive notes

script-src

The widget loader is fetched from feedjolt.com. It's a single small script; the iframe's JS is inside the iframe and uses its own CSP.

If you require nonces for inline scripts (no 'unsafe-inline'), the loader is external - no nonce needed. You don't need to nonce-tag the loader.

connect-src

The loader posts a few telemetry pings (open/close events for our anti-abuse logging) to feedjolt.com. Iframe API calls happen inside the iframe and use the iframe's own CSP, not yours.

frame-src

The iframe is <iframe src="https://www.feedjolt.com/widget?...">. Without this, the iframe is blocked at the framing layer and the widget never opens.

img-src

Workspace logos, post attachments, and changelog screenshots are served from cdn.feedjolt.com. data: and blob: cover SVG icons and uploaded images during preview.

style-src

The loader script injects a small <style> block to position the launcher. If you can't allow 'unsafe-inline', fall back to launcher CSS class targeting: hide our launcher with your own CSS and call window.feedjolt.open() from your custom button.

font-src

The widget uses Geist as the default font. Inside the iframe, fonts come from feedjolt.com.

Strict CSP example

A complete production CSP that allows the widget:

default-src 'self';
script-src 'self' 'nonce-{NONCE}' https://www.feedjolt.com;
connect-src 'self' https://www.feedjolt.com https://your-api.com;
frame-src https://www.feedjolt.com https://challenges.cloudflare.com;
img-src 'self' data: blob: https://cdn.feedjolt.com https://your-cdn.com;
font-src 'self' data: https://www.feedjolt.com;
style-src 'self' 'unsafe-inline';
form-action 'self';
base-uri 'self';
object-src 'none';
frame-ancestors 'none';
upgrade-insecure-requests;

frame-ancestors 'none' is fine - it controls who can frame you, not what you can frame.

CSP report-only

We strongly recommend running CSP in report-only mode while integrating, then promoting to enforce after a clean week of reports.

Content-Security-Policy-Report-Only: script-src ...; report-uri https://your-csp-collector;

If our domain shows up in a violation report, you've found a directive you missed. Add it; re-test.

Subresource Integrity (SRI)

We don't currently provide stable SRI hashes for widget-loader.js because the loader is updated continuously. If you need SRI for compliance, we recommend hosting a pinned copy of the loader on your CDN and updating it on a controlled schedule.

This trades off: a pinned loader gets strict SRI; you take on the responsibility of pulling updates. We'll happily provide signed builds on request.

Trusted Types

If you use Trusted Types CSP, the widget loader doesn't directly assign to innerHTML; the iframe's content is loaded via standard src attribute. You should not need a Trusted Types policy for the widget.

Common mistakes

• script-src 'self' only. Loader is at feedjolt.com, not 'self'. Add the explicit origin.
• Forgetting frame-src. Without this, the iframe never loads. The launcher button works but clicking it does nothing.
• img-src 'self' only. Workspace logos and customer-uploaded images come from cdn.feedjolt.com. They'll show as broken icons.
• CSP enforcement without testing. Always go report-only first.

CORS / cross-origin

The widget makes cross-origin requests from your page to feedjolt.com. We handle CORS server-side; you don't need to configure anything. If you see a CORS error in the console, it's likely CSP misreporting - check your CSP first.