---
description: How the Zendesk Web Widget works under a Content Security Policy, and how to send CSP violation reports to Report URI.
---

# Zendesk

Zendesk built the Web Widget around Google's strict CSP guidance rather than a domain allowlist, and they are unusually direct about the consequence: if your policy does not follow those guidelines, they will not guarantee the widget behaves.

## What Zendesk gives you

- Support for a strict, nonce-based CSP. Add the `nonce` attribute to the Web Widget snippet, with the value generated server-side per response.
- For custom policies, a documented baseline of `default-src 'self'`, with the same host allowances repeated into any narrower directives you have defined such as `script-src` or `connect-src`.
- An explicit statement that they cannot guarantee the widget won't violate a custom CSP that doesn't follow Google's guidelines - useful to know before you spend a day tuning one.

## Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Because Zendesk does not publish an exhaustive domain list, your own CSP reports are the practical way to discover what the widget actually loads in your configuration. Run report-only for long enough to cover a real support conversation, not just a page load.

## Things to watch for

- The widget's behaviour depends on which Zendesk products you have enabled, so two accounts can need different policies. Do not assume someone else's working policy transfers.
- Messaging features open WebSocket connections, which need `connect-src` entries with `wss:` origins - a directive people routinely forget until the widget connects but never receives anything.
- If you rely on the nonce route, the nonce must reach the widget snippet itself, not just your own scripts.

## Official documentation

[Zendesk - Content Security Policy (CSP) support](https://developer.zendesk.com/documentation/zendesk-web-widget-sdks/sdks/web/csp/)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)