Skip to content
DoshiDoshiDoshi for developersDOCS

Content Security Policy

What your page's Content Security Policy must allow for the SDK and the iframe.

If your page sends a Content-Security-Policy, it has to allow Doshi’s hosts. Two hosts serve the SDK, and one serves the iframe.

Merge these sources into your policy; do not paste the lines as given. Add them to the directives your policy already has. If you rely on default-src, keep your own sources, such as 'self', in each directive you add: a new connect-src replaces default-src for fetches, so without 'self' it blocks your own token endpoint.

These hosts are the same in Live and Test.

Host Address
Data: the member’s courses, lessons, progress and images https://core.doshi.app
API: lesson completions and rewards https://gateway.doshi.app
The iframe’s page https://surface.doshi.app

SDK

Section titled “SDK”
connect-src https://core.doshi.app https://gateway.doshi.app;
img-src https://core.doshi.app;
font-src data: https://core.doshi.app;

Images and your brand’s own font files load from the data host only. If you proxy our traffic with urls, name your proxy’s origins instead.

SDK releases before 0.3.0 call a different data host. To move without a gap, add https://core.doshi.app to connect-src, img-src and font-src beside the data host your policy already names, upgrade the SDK to 0.3.0, then remove the old host.

The SDK’s default fonts are inlined in its bundle as data: URLs, which is what font-src data: allows. It declares them in one <style> element it adds to your page’s <head>. Under a style-src without 'unsafe-inline', the browser refuses that element, and Doshi draws in fallback fonts.

Your brand’s own font files, the ones you send us, load from the data host, which is why font-src names it. The SDK registers them through the browser’s font API rather than a stylesheet, so style-src does not affect them. If your policy leaves the data host out of font-src, Doshi draws in your brand’s fallback fonts.

Iframe

Section titled “Iframe”
frame-src https://surface.doshi.app;

The frame’s own requests are its page’s business, not yours, so nothing else is needed. The other half of the handshake is ours: the frame only loads on the origins your console allows. See Allowed origins.