Skip to content
MDView as Markdown

Zendesk

Zendesk built the Web Widget around Google's strict CSP guidance rather than a domain allowlist, and they are unusually direct about the consequence: if your policy does not follow those guidelines, they will not guarantee the widget behaves.

What Zendesk gives you

  • Support for a strict, nonce-based CSP. Add the nonce attribute to the Web Widget snippet, with the value generated server-side per response.
  • For custom policies, a documented baseline of default-src 'self', with the same host allowances repeated into any narrower directives you have defined such as script-src or connect-src.
  • An explicit statement that they cannot guarantee the widget won't violate a custom CSP that doesn't follow Google's guidelines - useful to know before you spend a day tuning one.

Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the Setup page:

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Because Zendesk does not publish an exhaustive domain list, your own CSP reports are the practical way to discover what the widget actually loads in your configuration. Run report-only for long enough to cover a real support conversation, not just a page load.

Things to watch for

  • The widget's behaviour depends on which Zendesk products you have enabled, so two accounts can need different policies. Do not assume someone else's working policy transfers.
  • Messaging features open WebSocket connections, which need connect-src entries with wss: origins - a directive people routinely forget until the widget connects but never receives anything.
  • If you rely on the nonce route, the nonce must reach the widget snippet itself, not just your own scripts.

Official documentation

Zendesk - Content Security Policy (CSP) support

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page.

Start your free trial