Content Security Policy

The Content Security Policy (CSP) is a security standard introduced to prevent various attacks, including Cross-Site Scripting (XSS) and data injection attacks. It allows web developers to specify the domains the browser should consider valid sources of executable scripts for a given webpage.

By doing this, CSP can effectively reduce the risk of XSS attacks by specifying which sources are trusted, preventing browsers from executing scripts not approved as part of the policy.

If you choose to utilize CSP with Descope Flows, below is an example of a valid CSP configuration, including the necessary references to static.descope.com.

Customers without Custom Domain

<meta
http-equiv="Content-Security-Policy"
content="connect-src 'self' static.descope.com api.descope.com;
    style-src 'self' 'unsafe-inline' fonts.googleapis.com;
    img-src 'self' static.descope.com data:;
    font-src fonts.gstatic.com descopecdn.com data:;
    script-src 'self' descopecdn.com static.descope.com;"
/>

Customers with Custom Domain

In this example, the CNAME record is configured to be auth.example.com, with the App URL being https://example.com.

<meta
http-equiv="Content-Security-Policy"
content="connect-src 'self' auth.example.com;
    style-src 'self' 'unsafe-inline' fonts.googleapis.com;
    img-src 'self' auth.example.com data:;
    font-src fonts.gstatic.com descopecdn.com data:;
    script-src 'self' descopecdn.com static.descope.com;"
/>

Your CSP will need to include these references in order to effectively use flows without browser errors.