Intercom¶

Intercom is one of the better-documented widgets for CSP: they support strict CSP Level 3 with nonces outright, and publish an allowlist as a fallback for policies that cannot use nonces.

What Intercom gives you¶

Full support for strict CSPv3. If you already serve a nonce-based policy of the shape Google recommends, Intercom states you do not need to change anything:
```
Content-Security-Policy: object-src 'none'; script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:; base-uri 'self';
```
A source-allowlisting alternative if you cannot use CSP Level 2 or 3 features, with script-src entries for https://app.intercom.io, https://widget.intercom.io and https://js.intercomcdn.com.
Region-specific CDN domains, which only need adding for your workspace's own hosting region rather than all of them.

Sending reports to Report URI¶

Add the reporting directives to the policy you already serve, and set the two Reporting API headers that report-to sends through. Your URLs come from the Setup page:

Content-Security-Policy-Report-Only: object-src 'none'; script-src 'nonce-{random}' 'strict-dynamic' 'report-sha256'; base-uri 'self'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default
Reporting-Endpoints: default="https://abc123.report-uri.com/a/d/g"
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://abc123.report-uri.com/a/d/g"}],"include_subdomains":true}

'report-sha256' in script-src turns on CSP Integrity, which reports a hash of every script that loads.

Things to watch for¶

The Messenger loads scripts of its own, so some of them need a nonce source. If you have gone the nonce route, check the Messenger actually renders rather than assuming a clean report means it did.
The regional CDN domains matter. Allowlisting the wrong region's domain looks correct in the policy and still blocks the widget.
Support widgets have a habit of being added by a marketing team rather than an engineering one, so they show up in CSP reports before anyone tells you they exist. That is a good argument for Script Watch alongside the policy.

Official documentation¶

Intercom - Using Intercom with Content Security Policy

Start Monitoring with Report URI¶

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page.

Start your free trial