Content Security Policy
If your pages send a Content-Security-Policy header, allow our two hosts in the directives each mode uses. Keep everything your policy already allows.
Mode A: the core and the platform scripts
Spektrix, TNEW, Criterion, Viadukt, the shim and seatpreevue-core.js (or its ES module, seatpreevue-core-esm.js) all need:
| Directive | Add |
|---|---|
script-src |
https://assets.seatpreevue.com |
style-src |
https://assets.seatpreevue.com, and 'unsafe-inline' where a script adds its window's styles as a <style> element: Spektrix, Criterion, and seatpreevue-core.js's own dialog (show(document.body, …) or { inline: false }) |
connect-src |
https://connect.seatpreevue.com https://assets.seatpreevue.com |
img-src |
https://assets.seatpreevue.com data: (the viewer's icons are inlined in its stylesheet) |
A view drawn in your own element (show(element, …)) adds no <style>: with it, seatpreevue-core.js needs no 'unsafe-inline'. A policy that forbids inline styles blocks the dialog's <style>, so the dialog appears unstyled; draw the view in your own element instead (show(element, …)) if your policy forbids inline styles.
If your venue shows adverts in the view, also allow the advert service in connect-src, and img-src https: (advert images can come from any secure host): ask us for the exact host.
Mode B: the hosted view
| Directive | Add |
|---|---|
frame-src (or child-src, if you use that instead) |
https://assets.seatpreevue.com |
Nothing else: the frame loads everything itself, under our own policy. A report-only policy that doesn't list our host breaks nothing today, but stops the view the day it's enforced.
Mode C: headless
Only what your own viewer fetches: img-src https://assets.seatpreevue.com, and connect-src https://assets.seatpreevue.com if it fetches config.json with fetch(). The API calls come from your server, so need nothing in a page's policy.
The shim, while it falls back
The legacy shim shows a view the old way when a venue isn't on v1 yet. Until every venue has moved, keep what your policy allows today for the old script's host in connect-src and img-src.
Checking
Open the page with the browser's developer tools: a refused request shows in the Console as a CSP violation naming the directive. Add the host to that directive.