Docs / Développeurs
Cet article est affiché en anglais.
Content-Security-Policy
If your site sends a CSP, allow the SDK script, the worker, and API calls. Tighten to your own origin and the EngageNudge API you actually use.
Minimum directives
Content-Security-Policy:
script-src 'self' https://engagenudge.com;
worker-src 'self';
connect-src 'self' https://api.engagenudge.com;
img-src 'self' https: data:;https://engagenudge.com is where en-sdk.js is served from. If you still self-host /en-sdk.js, plain script-src 'self' is enough.
Service worker
worker-src 'self' (and older child-src 'self' if you still have it) must allow /en-sw.js. A missing worker-src is a common Install Doctor failure.
A service worker runs under the CSP sent with its own response, not the page's. If your server puts a CSP header on /en-sw.js, that header must allow https://engagenudge.com in script-src so the stub can importScripts the worker logic. The simplest fix is to send no CSP header on the worker file.
Images
Notification images are HTTPS URLs you choose (article images, your CDN). Allow those hosts on img-src.