Content Security Policy

Kaleidr's SDK runs in the customer page. That means the customer page's Content Security Policy has to allow the resources each product loads. This page is the recipe.

Product-by-product

Tile and Viewer (iframe products)

Tile and Viewer load the actual map inside map-embed.kaleidr.com, under Kaleidr's CSP. The parent page only has to allow the iframe itself and the SDK loader:

default-src 'self';
script-src  'self' https://cdn.kaleidr.com;
frame-src   https://map-embed.kaleidr.com;
connect-src 'self' https://api.kaleidr.com;

You do not need to allow Mapbox / MapTiler / OSM / vendor image hosts in the parent page when you only embed Tile or Viewer — those live inside the Kaleidr iframe.

Chat and Editor (in-page attach)

Chat and Editor mount MapLibre in the parent document. The parent page's CSP has to allow every host MapLibre and the SDK actually load:

default-src 'self';
script-src  'self' 'wasm-unsafe-eval' https://cdn.kaleidr.com;
style-src   'self' 'unsafe-inline' https://cdn.kaleidr.com;
connect-src 'self'
            https://api.kaleidr.com
            https://api.mapbox.com https://events.mapbox.com
            https://api.maptiler.com
            https://*.tiles.mapbox.com;
img-src     'self' data: blob:
            https://api.mapbox.com https://*.tiles.mapbox.com
            https://api.maptiler.com
            https://*.tile.openstreetmap.org;
worker-src  'self' blob:;
font-src    'self' data:;

'wasm-unsafe-eval' is required — MapLibre compiles WebAssembly at runtime and fails without it. If your CSP forbids 'wasm-unsafe-eval' you cannot mount Chat or Editor in-page today.

What breaks first

Symptom	Likely missing directive
SDK loader 404s or is blocked	script-src https://cdn.kaleidr.com
MapLibre init fails (Chat/Editor)	'wasm-unsafe-eval' in script-src
Tiles show up blank / grey	connect-src and/or img-src for the vendor host
Iframe never paints (Tile / Viewer)	frame-src https://map-embed.kaleidr.com
Session exchange 4xx from console	Not CSP — see Auth & scopes origin allowlist

Nonces and hashes

'unsafe-inline' is included in style-src above because MapLibre emits inline <style> blocks. If your CSP forbids 'unsafe-inline' today, use a nonce and re-emit the styles under that nonce — the SDK does not currently issue a per-load nonce; if you need one, open an issue against kaleidr-sdk.

Report-only rollout

The safe way to adopt this policy is:

1. Set the block above as Content-Security-Policy-Report-Only with a report-uri you own for one week.
2. Add hosts that appear in violation reports to the correct directive.
3. Promote the header to Content-Security-Policy once reports are quiet.