Skip to content

Instantly share code, notes, and snippets.

@marinhero

marinhero/Wootric-csp-demo.html

Last active April 10, 2024 12:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save marinhero/0b7dc607a5644d4ec634baf0799218d3 to your computer and use it in GitHub Desktop.
Save marinhero/0b7dc607a5644d4ec634baf0799218d3 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Wootric-csp-demo.html
<html>
<head>
<meta http-equiv="Content-Security-Policy"
content="connect-src https://*.wootric.com;
script-src 'nonce-EBVmWKEBEP' 'nonce-iApyYLoklC' 'strict-dynamic';
object-src 'none';
base-uri 'none';
img-src 'self' data;
font-src 'self' data:;" />
<meta charset="utf-8">
<script type="text/javascript" src="https://cdn.wootric.com/wootric-sdk.js" nonce="iApyYLoklC"></script>
<script type="text/javascript" nonce="EBVmWKEBEP">
window.wootricSettings = { account_token: 'NPS-YOURTOKEN', created_at: 1561852800 };
window.wootric('run');
</script>
</head>
<body>
</body>
</html>
@kaschka
Copy link

kaschka commented Aug 13, 2019 •
edited

Coming from http://help.wootric.com/en/articles/1634200-wootric-s-content-security-policy-csp-guidelines

Is this still up to date? Can't get <script async type="text/javascript" src="https://cdn.wootric.com/wootric-sdk.js"></script> to running without 'unsafe-inline' on Firefox and Edge.

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). index.html:2:18071

Example:

<html>
  <head>
    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src https://cdn.wootric.com/wootric-sdk.js";/>
    <meta charset="utf-8">
  </head>
  <body>
    <script type="text/javascript" src="https://cdn.wootric.com/wootric-sdk.js"></script>
  </body>
</html>

@marinhero
Copy link
Author

Hey @kaschka, there seems to be an issue there. I'm going to dig into it and will keep you posted. Thanks for reporting. Apologies for the trouble

@marinhero
Copy link
Author

@kascha, I updated the gist based on the example you sent me. I ran the new CSP header onto the Google CSP validator and got an ✅ from them. I hope this works for you as well! Let me know if you have more questions. Thanks for reporting this!

@jcr-workvivo
Copy link

Longshot @marinhero any chance of getting this CSP narrowed down a bit? *.wootric.com seems pretty open. e.g. Ideally this CSP wouldn't include your testing/qa environments etc...
Many thanks!

@alfredoschezvisma
Copy link

wootric-sdk.js also injects inline styles, so you need to add for the style-src policy: 'unsafe-inline' (which is not recommended) or the corresponding hash... The problem with hashing is that we can't control when Wootric style will change.
Can't you improve the nonce CSP approach for style-src as well?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment