Skip to main content
The Content-Security-Policy HTTP response header helps you reduce XSS risks on modern browsers by declaring which dynamic resources are allowed to load. If you are making use of CSP, you must add the following directives to your CSP header:
script-src needs 'unsafe-inline' or a nonce (see Nonce-based and strict-dynamic policies below). The SDK loads the messenger into a frame that inherits your page’s policy, and it writes one small inline script into that frame to set the messenger’s route. Without 'unsafe-inline' or a nonce that inline script is blocked, and features that open on a specific route (banners, modals, direct links to a conversation) can render the wrong view. If you would rather not allow 'unsafe-inline' at all, use a nonce.
We strongly recommend using the https://*.gleap.io and wss://*.gleap.io wildcards. The SDK contacts several Gleap subdomains (api.gleap.io, ws.gleap.io, sockets.gleap.io, messenger-app.gleap.io, outboundmedia.gleap.io, app.gleap.io, js.gleap.io), and the list may grow as we ship new features. Note that the https:// wildcard does not cover WebSocket connections — wss:// origins must be allowed separately.

​
WebSockets in connect-src

Gleap uses two WebSocket endpoints, and both must be allowed:
  • wss://ws.gleap.io — session and event streaming used by the JavaScript SDK.
  • wss://sockets.gleap.io — realtime delivery of conversations and notifications in the messenger.
If you’d rather not list them individually, allow wss://*.gleap.io.
Gleap previously relied on Pusher for realtime messaging, which required *.pusher.com entries in connect-src. Realtime traffic now runs entirely on Gleap infrastructure (wss://sockets.gleap.io), so any https://*.pusher.com or wss://*.pusher.com entries you added for Gleap can be removed.

​
Nonce-based and strict-dynamic policies

If your policy is nonce-based, the SDK can carry your nonce on everything it creates, including the messenger bundle and the inline route script described above. This requires SDK 16.3.4 or newer. The simplest setup is to put your nonce on the SDK’s own <script> tag. The SDK reads it from there automatically, and no further configuration is needed:
If your loader cannot put the nonce on that tag (some tag managers and bundlers cannot), pass it explicitly before calling Gleap.initialize():
With a nonce in place you no longer need 'unsafe-inline' in script-src, and you do not need to allowlist a content hash for the inline script.
If your policy uses 'strict-dynamic', a nonce is required. 'strict-dynamic' tells the browser to ignore host-based sources entirely, so https://*.gleap.io in script-src / script-src-elem has no effect and the messenger will not load without one. Hash-pinning the messenger bundle is not a workaround: its filename carries a build hash that changes with every release, and a hash source for an external script is only honored when the tag also carries a matching integrity attribute.
Note that 'strict-dynamic' only applies to script directives. frame-src, connect-src, img-src, font-src and media-src still need the origins listed above.

​
Strict CSPs without wildcards

If your security policy forbids wildcards, here is the full explicit allowlist the SDK uses today:
This explicit list can change without notice as we add features or migrate infrastructure. The https://*.gleap.io and wss://*.gleap.io wildcards are the safest choice.
Depending on your setup you might need to do some further customizations. Please check the browser console for any CSP errors and add the reported origins to the matching directive.