Content Security Policy (CSP)

Which CSP rules to allow so the Sirdata CMP works fully?

A Content Security Policy (CSP) is a security rule your site sends to the browser. It lists the domains the page is allowed to load scripts, data (JSON), fonts, images and styles from. Anything not listed is blocked.

If the CMP's domains are not listed, the browser blocks all or part of the CMP.

✅ Recognizing a block

The symptom depends on the rule that blocks:

What you see	CSP rule involved
The CMP does not show at all	script-src
The banner shows, but the purposes screen ("Set your choices") is incomplete, or some partners have no name	connect-src
The CMP shows without its styling	style-src
The CMP does not use the font chosen in its theme	font-src
The CMP's logo or illustration is missing	img-src

To confirm, open the browser console (F12 key, Console tab). Each block is reported with a message like this one:

Refused to connect to 'https://api.consentframework.com/api/v1/public/list/gvl/3?...' because it violates the following Content Security Policy directive: "connect-src ..."

⚙ The rules to add

Add these sources after the ones already present in your CSP:

Rule	Sources to add	What they allow
script-src	https://*.consentframework.com	the CMP's scripts
connect-src	https://*.consentframework.com	the texts and the partner list (JSON), saving the user's choices, statistics
font-src	https://*.consentframework.com	the font of the CMP's theme
img-src	data: https://*.consentframework.com https://cdn.sirdata.io	icons, theme illustrations, the logo uploaded to the platform
style-src	'unsafe-inline'	the CMP's styling

Example (the header fits on a single line, with rules separated by ;):

Content-Security-Policy: script-src 'self' https://*.consentframework.com; connect-src 'self' https://*.consentframework.com; font-src 'self' https://*.consentframework.com; img-src 'self' data: https://*.consentframework.com https://cdn.sirdata.io; style-src 'self' 'unsafe-inline'

Add these sources to your current rules, without replacing them. If a rule is missing from your CSP while default-src is present, default-src applies in its place: add the missing rule in full.

Why *.consentframework.com?

The CMP uses several subdomains of consentframework.com, and the * wildcard covers them all. If your security policy forbids wildcards, here is the detail:

Domain	Role	Rules
cache.consentframework.com	stub script	script-src
choices.consentframework.com	cmp script and its code, fonts, illustrations	script-src font-src img-src
api.consentframework.com	texts and partner list (JSON), saving the user's choices, statistics	connect-src
mychoice.consentframework.com	consent shared across several sites	connect-src

🧩 Special cases

Your CSP uses a nonce or 'strict-dynamic'

Add your nonce to the CMP's tags. The scripts the CMP loads afterwards are allowed by 'strict-dynamic'.

<script nonce="YOUR_NONCE" src="https://cache.consentframework.com/js/pa/XXXXX/c/YYYYY/stub"></script>
<script nonce="YOUR_NONCE" src="https://choices.consentframework.com/js/pa/XXXXX/c/YYYYY/cmp" async></script>

Your style-src uses a nonce or a hash

The browser then ignores 'unsafe-inline', and the CMP shows without its styling: it injects its styles without a nonce. style-src must contain 'unsafe-inline', with no nonce or hash in the same rule.

You condition scripts with the CMP (data-cmp-src)

• The domains of the scripts you condition must be allowed in your CSP, as if they were loaded directly.

• If you condition a local function (data-cmp-src="myFunction", see Local script management), script-src must contain 'unsafe-eval'. Without it, the function is never executed.

The CMP is loaded by Google Tag Manager

The Sirdata template loads the CMP from https://choices.consentframework.com: the rules above are enough for the CMP. Google Tag Manager has its own requirements, described in Google's CSP guide.

If you fill in a first-party host in the template, also add https://cdn.sirdata.eu to script-src, and your host as described below.

You use Sirdata's GTM server-side container

Your server-side sub-domain (for example metrics.your-site.com) serves the Google Tag Manager code and receives its measurement requests. With the Load the CMP from the server-side host option, it also serves the CMP: its scripts, texts, partner list, fonts and illustrations. Add it to these rules:

Rule	Source to add	What it allows
script-src	https://metrics.your-site.com	the integration script, Google Tag Manager and the Google scripts served by the container; the CMP
connect-src	https://metrics.your-site.com	measurement requests (Google Analytics…); the CMP's texts, partner list and statistics
img-src	https://metrics.your-site.com	measurement requests sent as images; the CMP's illustrations
font-src	https://metrics.your-site.com	the CMP theme font
frame-src	https://metrics.your-site.com	the iframe of Google's service worker, with the Allow Google's Service Workers option

When the CMP is served by the container, also keep:

• data: and https://cdn.sirdata.io in img-src: icons and the logo uploaded to the platform;

• 'unsafe-inline' in style-src: the CMP styling;

• https://mychoice.consentframework.com in connect-src, if consent is shared across several of your sites.

When the CMP is not served by the container, apply the CMP rules described above (https://*.consentframework.com).

The tags that Google Tag Manager loads from Google's domains (Google Ads, Floodlight, etc.) have their own requirements, described in Google's CSP guide.

The CMP is served from your own domain

Consent domain, first-party host, custom CDN: add this domain to script-src, connect-src, font-src and img-src. Also keep https://*.consentframework.com: the CMP uses it as a fallback and for some calls.

Options that load an additional script

Option	Source to add	Rule
Amazon Consent Signal	https://c.amazon-adsystem.com	script-src
Sirdata data partnership: the CMP loads the Sirdata tag after consent	https://js.sddan.com	script-src

Each partner's cookie details

On the partners screen, the more link in an IAB TCF partner's storage information loads a JSON file published by that partner, on its own domain (for example privacy.criteo.com). If connect-src blocks that domain, the panel shows "Information not available"; the rest of the CMP works.

To show it, add your partners' domains to connect-src (the browser console lists them when you open these panels), or https: if you accept to allow all HTTPS connections.

🔎 Test and validate

After the change, reload the page (Ctrl + Shift + R), then open the banner, Set your choices and the partners screen in turn. The console should no longer show any "Refused to … consentframework.com" message.

🌟 TL;DR

• CMP missing, incomplete purposes screen or partners without a name ✖: your CSP blocks all or part of the CMP

• Solution ✔: add https://*.consentframework.com to script-src, connect-src, font-src and img-src, plus data: and https://cdn.sirdata.io to img-src, and 'unsafe-inline' to style-src

• Sirdata GTM server-side container: also add your server-side sub-domain to script-src, connect-src, img-src, font-src and frame-src

• Where? In your site's Content-Security-Policy HTTP header

• Test: the browser console should no longer report anything 🚀

If in doubt, share this FAQ with your developer (they’ll get it right away 😉). Need help? We're here for you! 💡