Hello!
I am embanding live chat in my site, it is working fine in every browser but in safari browser it is not working fine, I am getting the error of “Content Security Policy” due to which chat widget is not working fine.
Here is the link of my site: https://cybercomplycorp.com/
Here is the screenshoot attached, you can see errors in console tab.
Hi @RJonathan,
The error you are seeing is related to the Content Security Policy (CSP) of the web page. It’s essentially security feature that is used to prevent things like Cross Site Scripting (XSS). “strict-src” is a directive that can be used as part of the CSP to specify valid sources of scripts being executed on the page itself. There are different sources that can be used as part of this (all listed here). The one you are seeing the issue with “strict-dynamic”. It is only supported in It is currenlty supported in Chrome 52+ / Edge 79+, Firefox 52+ and Safari 15.4.
Is the chat widget functioning at all? I can see from your screenshots that it is at least loading on page.Also what version of Safari are you using? Keeping in mind older versions don’t support this source directive.
In terms of a fixes, there aren’t a huge amount of options available. You could (and should if you haven’t) ensure you are using the most recent version of Safari or use an alternative browser with support for CSP (Chrome, Firefox). Failing that you could consider removing or modifying the CSP directive but that might do more damage than good considering the security benefits it brings to the table.
No chat widget is not working, on some versions of safari it is not even loading and the versions on which it is loading, after complete loading it is disabling the input controls and all links buttons etc.
Hi @RJonathan,
What verions of Safari? To find this go to the dock and select the Safari icon to open the Safari browser. Choose About Safari under the Safari menu. A small window appears with the browser version number. As mentioned certain versions of Safari to not support the use of the “strict-dynamic” directive.
Is there a publicly accessible page you could share with me so I could access via Safari to see if I can debug further?
Failing that I’m not sure I can be any more assistance unfortunately as issues like this are a server configuration issue that are not related to the third party script (HubSpot or otherwise) being utilised on the site. They’re rules set on a server level to prevent cyberattacks and control what sorts of assets can load.
Ultimately the fix for this is something that needs to be changed at a server level on your side. The way you would do this depends on the type of server your website is being hosted on.
