--- title: "Whitelisting guidelines" slug: "csp-guidelines-for-document360-widget" description: "Whitelisting in software products involves specifying a list of approved entities that are allowed to access certain resources or perform specific actions." updated: 2026-06-29T07:32:13Z published: 2026-06-29T07:32:13Z canonical: "docs.document360.com/csp-guidelines-for-document360-widget" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # Whitelisting guidelines Content Security Policy (CSP) is a browser security mechanism that controls which external sources — scripts, fonts, stylesheets, and API connections — are allowed to load on your web page. If your site has an existing CSP and you are embedding the Document360 widget, you must add the widget's trusted source URLs to your policy. Without these additions, the browser will block widget resources, causing symptoms such as missing scroll bars, blocked fonts, failed API calls, or CSP violation errors in the browser console. --- ## Before you begin - Confirm whether your knowledge base is hosted in the **US region** or the **EU region** — the trusted source URLs differ between regions. - Ensure you have access to your site's HTML or server configuration to edit the `Content-Security-Policy` header or `<meta>` tag. - Identify the nonce variable already available in your system. You will need to replace `"document360Nonce"` in the code samples with this value. --- ## How to add trusted CSP sources for the Document360 widget ### Update your Content Security Policy Add the following sources to your `connect-src`, `script-src-elem`, `font-src`, and `style-src-elem` directives. #### For US users ``` ``` Replace `"document360Nonce"` with the nonce variable already available in your system. #### For EU users ``` ``` Replace `"document360Nonce"` with the nonce variable already available in your system. NOTE The Algolia host URL in `connect-src` is environment-specific. If you are unsure of the exact host for your environment, use the wildcard `https://*.algolia.net` in your `connect-src` directive instead. This covers all Algolia environments and prevents CSP errors caused by mismatched hostnames. --- ### Update your widget configuration 1. Go to **Connections** () > Knowledge base widget in the left navigation sidebar of your knowledge base portal. 2. Select the required widget and click **Edit** (). 3. In the **Configure and connect** tab, expand the **Widget JavaScript** accordion under the **Connection** group. 4. Update your widget script with the nonce parameter as shown below. #### For US customers ``` ``` #### For EU customers ``` ``` Replace `"document360Nonce"` with the nonce variable already available in your system. The widget is now configured to operate securely within your CSP environment. --- ## FAQ **Why is the scroll bar not showing up on the Knowledge Base widget?** This is typically caused by a CSP rule that blocks the widget's domain. If your domain is not allowlisted in your CSP, it can prevent scroll functionality from working properly. [Add the domain URL to your application's CSP](/docs/csp-guidelines-for-document360-widget#how-to-add-trusted-csp-sources-for-the-document360-widget) to resolve this. **Do I need to add CSP sources if I am not using a nonce?** Yes. CSP sources for `connect-src`, `font-src`, and `style-src-elem` are required regardless of whether you use a nonce. The nonce is required specifically for `script-src-elem` to allow the widget script to execute. Without the nonce, you may need to use `'unsafe-inline'` for scripts, which is not recommended. **What is the difference between the US and EU CSP configurations?** The US and EU configurations differ in the CDN and API endpoint domains. US users point to `cdn.us.document360.io` and `api.us.document360.io`, while EU users use `cdn.document360.io` and `api.document360.io`. Using the wrong region's URLs will result in blocked resources and a non-functional widget. ## Related - [CSP directive reference](/content-security-policy.md) - [Apache HTTP server](/apache-http-server.md)