Content Security Policy
The origins to allow, and how to pass a nonce.
If your site sends a Content Security Policy, it has to allow the connector and the data plane.
| Directive | Allow | Why |
|---|---|---|
script-src | cdn.wolfigs.com | The connector, and the editor bundle for people who are editing. |
connect-src | api.cloud.wolfigs.com | Fetching the published manifest. |
img-src | api.cloud.wolfigs.com | Images uploaded through the editor, if you use them. |
style-src | 'unsafe-inline' | Responsive overrides are applied as an inline stylesheet. |
Nonces#
If your policy uses a nonce rather than an origin allowlist, pass it and the connector stamps it on the script it injects.
<Webnak siteKey="ilk_your_site_key" nonce={nonce} />