Content Security Policy

Running a strict Content Security Policy? Good. StageWhisper only needs three directive additions — one to load the widget, one to style it, and one to reach the API. Nothing else changes.

Required directives

Add these three sources to your policy, replacing <your-nonce> with the per-request nonce your framework already generates:

script-src 'nonce-<your-nonce>' https://cdn.stagewhisper.co;
style-src 'nonce-<your-nonce>';
connect-src https://api-staging.stagewhisper.co;

Nonce placement for the one-liner

The one-liner is a plain external script tag, so nonce placement is direct: put your nonce attribute on the loader <script> tag itself.

<script async src="https://cdn.stagewhisper.co/loader.js" data-sw-key="pub_your_site_key" nonce="<your-nonce>"></script>

On Rails, you can skip the manual attribute: render csp_meta_tag in your layout head and the loader reads the resulting meta[name="csp-nonce"] value as a fallback whenever the tag itself carries no nonce.

Nonce placement for the queue stub

Using the advanced queue-stub install? Put the nonce on the inline snippet's opening tag. From there it propagates the whole way down: snippet → loader → hashed bundle → the dynamically injected Shadow DOM <style> element. One nonce covers every layer, which is why style-src needs nothing beyond it.

Turnstile origins

When StageWhisper enables Cloudflare Turnstile for a site, also allow Turnstile's challenge origin in three directives:

script-src https://challenges.cloudflare.com;
frame-src https://challenges.cloudflare.com;
connect-src https://challenges.cloudflare.com;

Turnstile is disabled by default, and the widget does not load the Turnstile script unless the config endpoint returns an enabled Turnstile configuration — so you can skip these directives until you turn it on.