Embedding the ASAP Add-On on Sites with a Content Security Policy

Embedding the ASAP Add-On on Sites with a Content Security Policy

Injection-based attacks are some of the most severe and harmful security threats that websites/web apps face. Having a Content Security Policy (CSP) is a powerful way to guard against such attacks. If your website/app has a CSP with the script-src directive, you will not be able to embed the ASAP add-on using just the code snippet on the ASAP setup page. You need to modify the code a bit to make it happen.

Here's what you need to do.

To accommodate the ASAP add-on, the CSP must permit the execution of the ASAP snippet, which can be achieved by implementing the following steps:

Step 1: Generate a nonce value from your web browser.

Step 2: Pass the nonce value to the script-src directive of the Content-Security-Policy header, as follows:

Content-Security-Policy: script-src 'nonce-{place_the_unique_nonce_value_here}';


Step 3
: Pass the same nonce value to the script attribute in the ASAP code snippet.

<script nonce="{place_the_unique_nonce_value_here}" type="text/javascript"  src="https://desk.zoho.com/portal/api/web/inapp/102108000003860037?orgId=56965841%22  defer></script>

The ASAP add-on subsequently passes on the nonce value to any scripts that it adds to the page.

    Zoho CRM Training Programs

    Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.

    Zoho CRM Training
      Redefine the way you work
      with Zoho Workplace

        Zoho DataPrep Personalized Demo

        If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.

        Zoho CRM Training

          Create, share, and deliver

          beautiful slides from anywhere.

          Get Started Now


            Zoho Sign now offers specialized one-on-one training for both administrators and developers.

            BOOK A SESSION








                                You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.




                                    Manage your brands on social media

                                      Zoho Desk Resources

                                      • Desk Community Learning Series


                                      • Digest


                                      • Functions


                                      • Meetups


                                      • Kbase


                                      • Resources


                                      • Glossary


                                      • Desk Marketplace


                                      • MVP Corner


                                      • Word of the Day


                                        Zoho Marketing Automation

                                          Zoho Sheet Resources

                                           

                                              Zoho Forms Resources


                                                Secure your business
                                                communication with Zoho Mail


                                                Mail on the move with
                                                Zoho Mail mobile application

                                                  Stay on top of your schedule
                                                  at all times


                                                  Carry your calendar with you
                                                  Anytime, anywhere




                                                        Zoho Sign Resources

                                                          Sign, Paperless!

                                                          Sign and send business documents on the go!

                                                          Get Started Now




                                                                  Zoho TeamInbox Resources



                                                                          Zoho DataPrep Resources



                                                                            Zoho DataPrep Demo

                                                                            Get a personalized demo or POC

                                                                            REGISTER NOW


                                                                              Design. Discuss. Deliver.

                                                                              Create visually engaging stories with Zoho Show.

                                                                              Get Started Now







                                                                                            You are currently viewing the help articles of Sprints 1.0. If you are a user of 2.0, please refer here.

                                                                                            You are currently viewing the help articles of Sprints 2.0. If you are a user of 1.0, please refer here.



                                                                                                  • Related Articles

                                                                                                  • Generating nonces for the ASAP add-on

                                                                                                    Suppose your website or mobile app has a CSP (Content Security Policy) with script-src (a directive that controls a set of script-related privileges). In that case, you will not be able to embed the ASAP add-on using the regular code snippet. You ...
                                                                                                  • Working with the ASAP Add-On for the Web

                                                                                                    Introduction The ASAP add-on for websites makes your help center available within quick reach for your end-customers. By embedding this add-on with your website, you can provide your customers with easy access to your: Customer support team (to raise ...
                                                                                                  • Understanding the enhanced JWT mechanism for Authenticating Users in the ASAP Add-Ons

                                                                                                    Types of Users End-users can be categorized as guests or authenticated users based on how they log in to the ASAP add-on. Guest Users Guests are users who do not sign in while logging in to the ASAP add-ons. They can access the Knowledge Base module, ...
                                                                                                  • Working with the ASAP Add-Ons for Mobile Platforms

                                                                                                    The ASAP SDKs for mobile platforms--iOS and Android--make help available within quick reach for the end-users of your mobile apps. Using these SDKs, you can create and customize add-ons that reside within your app and provide end-users with easy ...
                                                                                                  • FAQs: Security

                                                                                                    What is TLS? The Transport Layer Security (TLS) protocol enables secure communications over a computer network by authenticating the data that is passed between the web server and the connected browser. For example, when you enter your login ...
                                                                                                    Wherever you are is as good as
                                                                                                    your workplace

                                                                                                      Resources

                                                                                                      Videos

                                                                                                      Watch comprehensive videos on features and other important topics that will help you master Zoho CRM.



                                                                                                      eBooks

                                                                                                      Download free eBooks and access a range of topics to get deeper insight on successfully using Zoho CRM.



                                                                                                      Webinars

                                                                                                      Sign up for our webinars and learn the Zoho CRM basics, from customization to sales force automation and more.



                                                                                                      CRM Tips

                                                                                                      Make the most of Zoho CRM with these useful tips.



                                                                                                        Zoho Show Resources