# Content Securty Policy **URL:** \ **Category:** Web\ **Created:** [September 18, 2019, 4:15am UTC](https://devforum.zoom.us/t/content-securty-policy/5945 "2019-09-18T04:15:04Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![sdenardi](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@sdenardi](https://devforum.zoom.us/u/sdenardi)\ **Post date:** [September 18, 2019, 4:15am UTC](https://devforum.zoom.us/t/content-securty-policy/5945/1 "2019-09-18T04:15:04Z")
I’m integrating the Web SDK into an existing web project that utilizes a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) to restrict what gets run on the page. In the process of development, I’ve noticed that the SDK requires these additional directives: ```auto connect-src: *.zoom.us zoom.us wss://*.zoom.us font-src: 'data:' script-src: *.zoom.us zoom.us 'unsafe-eval' worker-src: 'blob:' ``` Am I missing any other URLs or directives that are required by the library? ---
**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\ **Post date:** [September 18, 2019, 7:36pm UTC](https://devforum.zoom.us/t/content-securty-policy/5945/2 "2019-09-18T19:36:35Z")
Hi @sdenardi, Are you using our WebSDK sample-web-app or the npm module? ---
**Author:** ![sdenardi](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@sdenardi](https://devforum.zoom.us/u/sdenardi)\ **Post date:** [September 18, 2019, 8:07pm UTC](https://devforum.zoom.us/t/content-securty-policy/5945/3 "2019-09-18T20:07:19Z")
I’m using the npm module in an existing project that uses CSP headers. ---
**Author:** ![JackYang](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jackyang/32/1135_2.png) [@JackYang](https://devforum.zoom.us/u/JackYang)\ **Post date:** [September 20, 2019, 2:05am UTC](https://devforum.zoom.us/t/content-securty-policy/5945/5 "2019-09-20T02:05:52Z")
WebSDK use Global CDN `source.zoom.us` or `dmogdx0jrul3u.cloudfront.net` China CDN `jssdk.zoomus.cn` to solve the dependencies. [https://github.com/zoom/zoomus-jssdk/tree/master/dist](https://github.com/zoom/zoomus-jssdk/tree/master/dist) it contain all css. font, js and wasm files. same as [https://www.npmjs.com/package/zoomus-jssdk](https://www.npmjs.com/package/zoomus-jssdk) [https://zoom.github.io/sample-app-web/ZoomMtg.html#setZoomJSLib](https://zoom.github.io/sample-app-web/ZoomMtg.html#setZoomJSLib) the api use to change the dependencies location. ```auto // ZoomMtg.setZoomJSLib('https://dmogdx0jrul3u.cloudfront.net/1.5.1/lib', '/av'); // CDN version default // ZoomMtg.setZoomJSLib('https://source.zoom.us/1.5.1/lib', '/av'); // Global use source.zoom.us // ZoomMtg.setZoomJSLib('https://jssdk.zoomus.cn/1.5.1/lib', '/av'); // China use jssdk.zoomus.cn ``` the communication use wss://\*.zoom.us (not include china) so I think if you use `source.zoom.us`, you CSP configuration is right. Thanks ---
**Author:** ![spencermarx](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/spencermarx/32/4323_2.png) [@spencermarx](https://devforum.zoom.us/u/spencermarx)\ **Post date:** [March 27, 2020, 5:03pm UTC](https://devforum.zoom.us/t/content-securty-policy/5945/6 "2020-03-27T17:03:32Z")
Hey there @JackYang & @michael_p.zoom, my name is Spencer. I hope this message finds you well. My company is currently trying to integrate the Zoom Web SDK into our SPA and need to configure CSP using nginx. **Context** We have a functioning video chat when running locally, but as soon as we deployed the feature to our upper environments (which are all running on a higher level security protocol / HTTPS) we found a slew of CSP errors in our console. We found this thread and attempted addressing the CSP issues. Up to this point, we have updated our headers several times to allow all necessary Zoom connections, but to no avail. Below you can see our current CSP header taken from our _security.conf_ file (nginx): `add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; connect-src 'self' *.zoom.us zoom.us wss://*.zoom.us; font-src 'self' 'data:'; script-src 'self' *.zoom.us zoom.us 'unsafe-eval'; worker-src 'self' 'blob:'" always;` **The Errors** With the update above, we now have other CDN’s being blocked and a variety of different CSP complaints in our Chrome Browser console: ![Screen Shot 2020-03-27 at 12.56.21 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/e/ed4704c3e554f91fb339551e9550288be25de5be.png) **Our Ask** Do you have a recommendation forward for configuring CSP in nginx for the Zoom Web SDK that won’t create issues with our other CDN’s? Thanks so much in advanced and looking forward to hearing from you! 😊 ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [March 27, 2020, 10:09pm UTC](https://devforum.zoom.us/t/content-securty-policy/5945/9 "2020-03-27T22:09:15Z")
Hey @spencermarx, thanks for posting and using Zoom! Looks like those errors aren’t coming from the Web SDK. Are you using the [Local Version](https://www.npmjs.com/package/@zoomus/websdk) or [CDN Version of the Web SDK](https://marketplace.zoom.us/docs/sdk/native-sdks/web/getting-started/integrate#cdn)? Thanks, Tommy ---
**Author:** ![spencermarx](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/spencermarx/32/4323_2.png) [@spencermarx](https://devforum.zoom.us/u/spencermarx)\ **Post date:** [April 3, 2020, 6:10pm UTC](https://devforum.zoom.us/t/content-securty-policy/5945/10 "2020-04-03T18:10:02Z")
That is correct. They are CSP errors output by the browser. We actually resolved this by reconfiguring our nginx security.config file. My apologies for the delay in response, it’s been a busy week for us. Thank you @tommy for taking a look at this 😊 Best, Spencer Marx ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 3, 2020, 8:01pm UTC](https://devforum.zoom.us/t/content-securty-policy/5945/11 "2020-04-03T20:01:16Z")
Happy to help! Glad you got it resolved! Please due note the current status of the Web SDK: We are working to get the [Zoom Web Client](https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web-client) and [Zoom Web SDK](https://marketplace.zoom.us/docs/sdk/native-sdks/web) back online. Please keep up with our status page for detailed updates: [status.zoom.us](http://status.zoom.us/) > [@Developer impacting changes during COVID-19](https://devforum.zoom.us/t/developer-impacting-changes-during-covid-19/8930): > > [Developer impacting changes during COVID-19](https://devforum.zoom.us/t/developer-impacting-changes-during-covid-19/8930)Zoom Developer Documentation Survey Please take a few minutes to fill out the [Zoom Developer Docs survey](https://forms.gle/mHCNSZuWfsNDcyMc8) and let us know how we can assist you better with our docs. Your input will be invaluable in improving our documentation. Delayed responses by Zoom staff on developer forum due to volume of posts. Expect a reply in 24 hours on weekdays. What does this mean? During these tough times, we are seeing a massive increase in demand for our services. To … * * * The best workaround is to use the Zoom Desktop / Mobile app. Just include the Zoom meeting join url (`https://zoom.us/j/meetingID`) on your site rather than showing the websdk / iframe. Clicking on the join url will open the Zoom meeting in the Zoom app. Apologies for the inconvenience, Tommy ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 8:14pm UTC](https://devforum.zoom.us/t/content-securty-policy/5945/12 "2020-08-21T20:14:36Z")
Closed on August 21, 2020, 8:14pm UTC