> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/verify/liveness/integration/liveness-web-sdk/content-security-policy-csp.md).

# Content Security Policy (CSP)

To ensure seamless functionality of the Vida Web SDK, update your Content Security Policy (CSP) and network whitelist to allow the following resource:

**script-src**

{% code expandable="true" %}

```shellscript
Content-Security-Policy: script-src 'self' https://web-sdk.vida.id https://shield.vida.id; 'wasm-unsafe-eval';
```

{% endcode %}

'wasm-unsafe-eval' is required for face detection (WebAssembly).

**Additional CSP Directives** (Only required if you have these directives enforcement)

The SDK also makes API calls and loads additional resources based on the workflow configs. Add the following to your connect-src and img-src.

#### Production Env

{% code expandable="true" %}

```shellscript
connect-src 'self' https://sdk-api.prod.vida.id https://shield.vida.id https://faro-collector-prod-ap-southeast-1.grafana.net https://vida-prod-tijori-1.s3.ap-southeast-3.amazonaws.com;
img-src 'self' https://pixel-shield.vida.id;
```

{% endcode %}

{% hint style="info" %}
**Note:** `https://shield.vida.id` & `https://pixel-shield.vida.id` are **required** only if you have **ID Fraud shield enabled**

`https://vida-prod-tijori-1.s3.ap-southeast-3.amazonaws.com` is **required** only if you have **liveness color flash enabled**
{% endhint %}

#### Sandbox Env

{% code expandable="true" %}

```shellscript
script-src 'self' https://web-sdk.vida.id https://sandbox-shield.vida.id; 'wasm-unsafe-eval';
connect-src 'self' https://sandbox-sdk-api.np.vida.id https://sandbox-shield.vida.id https://faro-collector-prod-ap-southeast-2.grafana.net https://vida-sandbox-tijori-1.s3.ap-southeast-3.amazonaws.com;
img-src 'self' https://sandbox-pixel-shield.vida.id;
```

{% endcode %}

{% hint style="info" %}
**Note:**`https://sandbox-shield.vida.id` & `https://sandbox-pixel-shield.vida.id` are **required** only if you have **ID Fraud shield enabled**

`https://vida-sandbox-tijori-1.s3.ap-southeast-3.amazonaws.com` is **required** only if you have **liveness color flash enabled**<br>

**Tip**: You can use `https://*.vida.id` in place of individual subdomains if your policy allows wildcards. The Grafana collector ( used for error/crash logging ) and the S3 upload hosts ( used only for color flash ) must always be added explicitly.
{% endhint %}

### Network / Firewall Whitelist

Allow outbound HTTPS (port 443) to: (**only needed if SDK is used in an environment that enforces egress filtering or outbound firewall rules**)

{% tabs %}
{% tab title="Production" %}
{% code expandable="true" %}

```java
web-sdk.vida.id 
sdk-api.prod.vida.id 
shield.vida.id 
pixel-shield.vida.id 
faro-collector-prod-ap-southeast-1.grafana.net
vida-prod-tijori-1.s3.ap-southeast-3.amazonaws.com
```

{% endcode %}
{% endtab %}

{% tab title="Sandbox" %}
{% code expandable="true" %}

```java
web-sdk.vida.id 
sandbox-sdk-api.np.vida.id 
sandbox-shield.vida.id 
sandbox-pixel-shield.vida.id 
faro-collector-prod-ap-southeast-2.grafana.net
vida-sandbox-tijori-1.s3.ap-southeast-3.amazonaws.com
```

{% endcode %}
{% endtab %}
{% endtabs %}

{% hint style="info" %}
**Tip**: Use `*.vida.id` to cover all Vida-owned hosts with a single rule. The Grafana collector and the S3 upload host must still be whitelisted explicitly.

No inbound ports are required. If TLS inspection is enabled, exclude these hosts to avoid certificate failures.
{% endhint %}