From 919727452815801922b1451471aa8279d7061d42 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Mon, 19 Aug 2024 13:47:47 +0200 Subject: [PATCH] Add documentation on CSP for the widget (#4398) --- doc/user/events/widget.rst | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/doc/user/events/widget.rst b/doc/user/events/widget.rst index ce06232b9..289615798 100644 --- a/doc/user/events/widget.rst +++ b/doc/user/events/widget.rst @@ -450,6 +450,19 @@ Further reading: * `Stripe Payment Method Domain registration`_ +Content Security Policy +----------------------- + +When using a Content Security Policy (CSP) on your website, you may need to make some adjustments. If your pretix +shop is running under a custom domain, you need to add the following rules: + +* ``script-src``: ``'unsafe-eval' https://pretix.eu`` (adjust to your domain for self-hosted pretix) +* ``style-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted) +* ``connect-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted) +* ``frame-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted) +* ``img-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted) and for pretix Hosted additionally add ``https://cdn.pretix.space`` + + External payment providers and Cross-Origin-Opener-Policy ---------------------------------------------------------