Skip to main content
The Content-Security-Policy HTTP response header helps you reduce XSS risks on modern browsers by declaring which dynamic resources are allowed to load. If you are making use of CSP, you must add the following directives to your CSP header:
We strongly recommend using the https://*.gleap.io wildcard. The SDK contacts several Gleap subdomains (api.gleap.io, ws.gleap.io, messenger-app.gleap.io, outboundmedia.gleap.io, app.gleap.io, js.gleap.io), and the list may grow as we ship new features.

​
Why Pusher is in connect-src

The Gleap messenger uses Pusher for realtime delivery of conversations and notifications. Pusher routes to a regional cluster, so the exact host depends on where your workspace lives:
  • EU workspaces: wss://ws-eu.pusher.com and https://sockjs-eu.pusher.com
  • US workspaces: wss://ws-mt1.pusher.com and https://sockjs-mt1.pusher.com
  • Other regions follow the same ws-{cluster}.pusher.com / sockjs-{cluster}.pusher.com pattern.
To stay region-portable, allow the wildcards https://*.pusher.com and wss://*.pusher.com in connect-src rather than pinning a single cluster.

​
Strict CSPs without wildcards

If your security policy forbids wildcards, here is the full explicit allowlist the SDK uses today:
This explicit list can change without notice as we add features or migrate infrastructure. The *.gleap.io and *.pusher.com wildcards are the safest choice.
Depending on your setup you might need to do some further customizations. Please check the browser console for any CSP errors and add the reported origins to the matching directive.