Zendesk¶

Zendesk built the Web Widget around Google's strict CSP guidance rather than a domain allowlist, and they are unusually direct about the consequence: if your policy does not follow those guidelines, they will not guarantee the widget behaves.

What Zendesk gives you¶

Support for a strict, nonce-based CSP. Add the nonce attribute to the Web Widget snippet, with the value generated server-side per response.
For custom policies, a documented baseline of default-src 'self', with the same host allowances repeated into any narrower directives you have defined such as script-src or connect-src.
An explicit statement that they cannot guarantee the widget won't violate a custom CSP that doesn't follow Google's guidelines - useful to know before you spend a day tuning one.

Sending reports to Report URI¶

Add the reporting directives to your policy, and set the two Reporting API headers that report-to sends through. Your URLs come from the Setup page:

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'nonce-{random}' 'strict-dynamic' 'report-sha256'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default
Reporting-Endpoints: default="https://abc123.report-uri.com/a/d/g"
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://abc123.report-uri.com/a/d/g"}],"include_subdomains":true}

'report-sha256' in script-src turns on CSP Integrity, which reports a hash of every script that loads.

Because Zendesk does not publish an exhaustive domain list, your own CSP reports are the practical way to discover what the widget actually loads in your configuration. Run report-only for long enough to cover a real support conversation, not just a page load.

Things to watch for¶

The widget's behaviour depends on which Zendesk products you have enabled, so two accounts can need different policies. Do not assume someone else's working policy transfers.
Messaging features open WebSocket connections, which need connect-src entries with wss: origins - a directive people routinely forget until the widget connects but never receives anything.
If you rely on the nonce route, the nonce must reach the widget snippet itself, not just your own scripts.

Official documentation¶

Zendesk - Content Security Policy (CSP) support

Start Monitoring with Report URI¶

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page.

Start your free trial