Content Security Policy

If your site sends a Content-Security-Policy header or meta tag, it must allow Grona’s two domains, or the browser blocks parts of the runtime. This page lists every directive Grona needs, gives a complete policy to start from, and explains the cases that need more.

Directives

Directive	Source	Why
script-src	https://cdn.grona.ai	Loads antiflicker.js and main.js.
connect-src	https://cdn.grona.ai	main.js downloads each variation’s changes file from the CDN.
connect-src	https://api.grona.ai	Tracking events and preview data go to the API.
img-src	https://cdn.grona.ai	Images and assets used in variations are served from the CDN.
style-src	'unsafe-inline'	The anti-flicker <style>, the CSS of inserted blocks and style overrides are inline styles.
script-src	'unsafe-inline'	Only if a variation inserts a block that contains JavaScript. See below.

The preconnect link needs no directive.

A complete policy

This policy allows Grona alongside your own origin. Merge Grona’s sources into your existing directives rather than replacing them.

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.grona.ai; connect-src 'self' https://cdn.grona.ai https://api.grona.ai; img-src 'self' https://cdn.grona.ai; style-src 'self' 'unsafe-inline'

The same policy as a meta tag, placed before the Grona snippet:

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://cdn.grona.ai; connect-src 'self' https://cdn.grona.ai https://api.grona.ai; img-src 'self' https://cdn.grona.ai; style-src 'self' 'unsafe-inline'">

cdn.grona.ai belongs in connect-src too

A policy that allows cdn.grona.ai only in script-src lets both scripts load, but blocks the download of the variation’s changes. Visitors then silently see the original page, and they are not counted in the campaign. Nothing on the page looks broken, so check the browser console for CSP errors after you deploy a policy.

Inserted blocks with JavaScript

Some variations insert a new block into the page, such as a free-delivery progress bar. If the block contains JavaScript, Grona adds it as an inline <script> element without a nonce. Under a policy without 'unsafe-inline' in script-src, the browser blocks that script and the runtime logs a console message that CSP likely blocked it.

If your policy cannot allow 'unsafe-inline' scripts, avoid variations whose inserted blocks need JavaScript. Blocks that load resources from other origins also need those origins in your policy; they depend on the block, so check each one in preview.

Trusted Types

Grona writes inserted blocks with innerHTML. On pages that enforce require-trusted-types-for 'script', the browser rejects those writes and inserted blocks fail.

No eval

The runtime never uses eval or new Function, so your policy does not need 'unsafe-eval'.

The visual editor

The visual editor opens your page through Grona’s servers, which take care of framing, so it needs no extra entries in your policy. See Visual editor requirements.