Content Security Policy (CSP)

How to configure your CSP to allow the Korvus snippet on your site.

What is a CSP?

A Content Security Policy is an HTTP header that tells the browser which domains are allowed to load scripts and send requests from your site. If your site uses a strict CSP, you need to add the Korvus domains to it.

If you don't know whether your site has a CSP, it most likely runs without one. Your developer can check your site's HTTP headers (DevTools → Network → click the page → Headers tab → look for Content-Security-Policy).

Installing via GTM

Google Tag Manager is already allowed in the CSP of almost every e-commerce site. If you install Korvus through GTM, you only need to allow data to be sent:

connect-src https://app.korvus.fr;

Add this domain to your existing connect-src directive.

Direct installation (without GTM)

If you load the Korvus snippet directly in your HTML (without GTM), two directives are required:

script-src https://cdn.korvus.fr;
connect-src https://app.korvus.fr;

• script-src allows the script to load from the Korvus CDN
• connect-src allows data to be sent to the Korvus API

Full example

If your current CSP looks like this:

Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com; connect-src 'self'

Add the Korvus domains:

Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com https://cdn.korvus.fr; connect-src 'self' https://app.korvus.fr

How to check

Method 1: browser console

Open your browser's DevTools (F12) and go to the Console tab. If the CSP is blocking Korvus, you will see a message like:

Refused to connect to 'https://app.korvus.fr/api/ingest' because it violates the following Content Security Policy directive: "connect-src 'self'"

Method 2: Network tab

In DevTools, go to the Network tab and look for requests to app.korvus.fr. If no request shows up even though the snippet has loaded, the CSP is probably blocking data from being sent.

Signs of a CSP block

• The snippet loads correctly (visible in Network)
• No data shows up in the Korvus dashboard
• Refused to connect or Refused to load the script errors appear in the console
• The snippet automatically detects the block and fails silently, with no impact on your site

Domains to allow

No other domain is needed. Korvus does not load third-party resources (no fonts, no images, no iframes).