0

I am trying to use a nonce to avoid allowing unsafe-inline/unsafe-eval in my CSP for my site where I am using the new (messenger) version of the Zendesk chat widget.

I followed the steps here -> https://developer.zendesk.com/documentation/zendesk-web-widget-sdks/sdks/web/csp/ and added a nonce to my script tags. The nonce seems to be coming through correctly, but I still get console errors saying that inline style cannot be applied.

Here's how I have the script tags used in my .cshtml file:

<!-- Start of Zendesk Widget script -->
    <script nonce="@ViewBag.nonce" id="ze-snippet" src="https://static.zdassets.com/ekr/snippet.js?key=[mykey]"></script>
    <!-- End of Zendesk Widget script -->
    
    <script type="text/javascript" nonce="@ViewBag.nonce">

        function initZendeskWidget() {
            if (typeof zE !== 'undefined') {
                zE('messenger', 'hide');  // Hide everything on load

                $('#chat-link').on('click', () => showZendeskChatWidget()); // Attach click handler
            } else {
                setTimeout(initZendeskWidget, 500); // Retry until widget loads

            }
        }

        function showZendeskChatWidget() {
           zE('messenger', 'show');
           setTimeout(openChat,500);
        }

        function openChat() {
            let chatLauncherButton = document.getElementById("launcher").contentWindow.document.querySelector('[data-testid="launcher"]');
            chatLauncherButton.click();
        }

        initZendeskWidget();
    </script>

The nonce is correct and matches that of the CSP policy for style-src-elem. But I get this error in my console:

web-widget-main-0063182.js:2 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src-elem 'self' 'nonce-wwO5dbb2vZ2pH79ycW+qdA=='". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution.

As you can see in the error message, the nonce is a part of my CSP directive for style-src-elem, and it's the same nonce in the html in the Sources tab:

 <!-- Start of crowdtech Zendesk Widget script -->
    <script nonce="wwO5dbb2vZ2pH79ycW+qdA==" id="ze-snippet" src="https://static.zdassets.com/ekr/snippet.js?key=[mykey]"></script>
    <!-- End of crowdtech Zendesk Widget script -->
    
    <script type="text/javascript" nonce="wwO5dbb2vZ2pH79ycW+qdA==">

What am I missing here? Trying to harden my CSP policy so I don't want to include unsafe-inline if at all possible. The help article included above implies that this should be possible.

(snippet key replaced with [mykey] for privacy)

5
  • developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/…: "The [...] style-src-elem directive specifies valid sources for stylesheet <style> elements and <link> elements with rel="stylesheet". The directive does not set valid sources for inline style attributes; these are set using style-src-attr" Commented Oct 1 at 8:02
  • Thanks for your response. If the style-src-elem directive isn't relevant to the nonce for the zendesk widget, why is that the directive that is throwing a CSP error? I tried adding the same sources for style-src-attr but that didn't seem to fix this issue, since it is related to the style-src-elem directive Commented Oct 1 at 8:35
  • I guess "inline style" might be ambiguous here. I took it to mean some element.style.property = ... assignment, but apparently dynamically created style elements might also be considered "inline" here. But for style-src-elem 'self' 'nonce-wwO5dbb2vZ2pH79ycW+qdA==' to have any effect on a style element dynamically created by the script, that style element itself would need to have that nonce set - which the script won't do. Commented Oct 1 at 8:55
  • 1
    Their "Custom setup" further down the page you linked to, explicitly contains style-src 'unsafe-inline'; - so I don't know if there is a way to avoid that, using their current implementation. Commented Oct 1 at 8:56
  • Unfortunatelly, it seems that currently the Zendesk chat widget requires a style-src unsafe-inline directive: "Regrettably, I must inform you that our current setup does not support this functionality, as the Web Widget (Classic) necessitates the inclusion of 'unsafe-inline'. Although there have been previous attempts to investigate and resolve this matter, we have yet to find a definitive solution."(support.zendesk.com/hc/it/community/posts/…) Commented Oct 28 at 15:50

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.